Who We Are
FGCD Ltd (trading as Fair Game) is the data controller responsible for your personal data. We are registered in Northern Ireland (Company No. NI741782) and operate the competition platform at fairgamecompetitions.co.uk.
If you have any questions about this policy or how we handle your data, please contact us at hello@fairgamecompetitions.co.uk.
What We Collect
We collect the following personal data when you use our platform:
Account Information
- First and last name
- Email address
- Date of birth (to verify you are 18 or over)
- Phone number (optional)
- Postcode (optional, for prize delivery)
- Encrypted password (we never store passwords in plain text)
Transaction Data
- Ticket purchases — competition, quantity, amount paid, date
- Assigned ticket numbers
- Payment method (Stripe reference — we do not store full card details)
- Wallet top-ups, withdrawals, and balance history
- Site credit balance and transaction history
Postal Entry Data
- Name, home address, date of birth, and email address provided on free postal entries
Responsible Gambling Data
- Spending limits you set (daily, weekly, monthly)
- Self-exclusion periods and status
Technical Data
- IP address (for fraud prevention)
- Browser type and device information
- Session data and login timestamps
How We Use It
We use your personal data for the following purposes:
- Running your account — registration, sign-in, profile management
- Processing ticket purchases — assigning unique ticket numbers, generating receipts
- Delivering prizes — contacting and verifying winners, arranging prize delivery
- Email communications — ticket confirmation emails, draw result notifications, new competition alerts (if opted in)
- Winner publicity — if you win, publishing your first name, last name initial, general location, and ticket number as described in our Terms (Section 9), which also explains how to request anonymity
- Responsible gambling — enforcing spending limits and self-exclusions you have set
- Age verification — confirming you are 18 or over before allowing entry
- Fraud prevention — detecting and preventing fraudulent accounts or purchases
- Legal compliance — maintaining records as required by UK law
- Improving our service — understanding how our platform is used (aggregated, anonymised)
Legal Basis for Processing
Under UK GDPR, we must have a legal basis for processing your personal data. We rely on the following:
- Contract — processing necessary to fulfil your competition entries and deliver prizes
- Legal obligation — age verification, fraud prevention, financial record-keeping
- Legitimate interests — platform security, fraud detection, service improvement, publishing minimal winner details to demonstrate draw integrity (you may object), and retaining a minimal identifying record after account closure so self-exclusions stay enforceable
- Consent — marketing emails and SMS reminders (you can withdraw consent at any time)
Who We Share Your Data With
We only share your data with third parties where necessary:
- Supabase — our database and authentication provider (data stored in EU/UK data centres)
- Stripe — payment processing. Stripe handles card data directly and is PCI-DSS compliant. We never see or store your full card details.
- Resend — our email provider, sending transactional emails (ticket numbers, receipts, draw results)
- Law enforcement / regulators — if required by law, court order, or to protect our legal rights
Cookies
We use cookies and similar technologies to keep you signed in and improve your experience. Types we use:
- Essential cookies — session management, authentication (required, cannot be disabled)
- Payment cookies — set by Stripe when processing payments
- Analytics and advertising cookies — e.g. Google Analytics, and advertising tools such as Meta or TikTok Pixel where used. These are optional and are only set after you actively accept them via our cookie banner — you're free to reject these at any time without it affecting how the site works.
You can manage cookie preferences through your browser settings, or by using the cookie banner shown when you first visit the site. Disabling essential cookies will prevent you from signing in.
Data Retention
We retain your data for the following periods:
- Active account data — for as long as your account is open
- Transaction records — 7 years (required for UK tax and accounting purposes)
- Draw entry records — a minimum of 12 months after the draw date (for transparency, auditing, and dispute resolution)
- Marketing data — until you unsubscribe or withdraw consent
- Self-exclusion records — retained even after account closure to prevent re-registration during exclusion period
When you request account deletion, we remove all data not required for legal compliance within 30 days.
Your Rights Under UK GDPR
You have the following rights regarding your personal data:
- Right of access — request a copy of all data we hold about you
- Right to rectification — correct inaccurate or incomplete data
- Right to erasure — request deletion of your data ("right to be forgotten")
- Right to restrict processing — limit how we use your data
- Right to data portability — receive your data in a machine-readable format
- Right to object — object to processing based on legitimate interests or for direct marketing
- Right to withdraw consent — withdraw marketing consent at any time without affecting other processing
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
International Data Transfers
Your data is primarily stored within the UK and European Economic Area (EEA). Where we use third-party providers based outside the UK/EEA (such as some Stripe infrastructure), we ensure appropriate safeguards are in place, including:
- UK International Data Transfer Agreements (IDTAs)
- Standard Contractual Clauses (SCCs) approved by the ICO
- Adequacy decisions recognised by the UK government
Children
We verify date of birth at registration and may request additional proof of age at any time.
Security
We take data security seriously and implement the following measures:
- All data transmitted over HTTPS (TLS encryption)
- Passwords hashed using industry-standard algorithms — never stored in plain text
- Database access restricted by Row Level Security — users can only access their own data
- Payment processing handled entirely by our PCI-DSS compliant provider (Stripe) — we never touch card data
- Regular security reviews and access audits
- Staff access to personal data limited to those who need it
In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the ICO within 72 hours as required by UK GDPR.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make significant changes, we will notify you by email and update the "Last updated" date at the top of this page.
Continued use of our platform after changes are published constitutes acceptance of the updated policy.
Contact Us
For any privacy-related queries, data subject requests, or complaints:
- Email: hello@fairgamecompetitions.co.uk
- Post: Data Protection Contact, FGCD Ltd, 173 Avoniel Road, Belfast, BT5 4SG
- ICO (complaints): ico.org.uk / 0303 123 1113
We aim to respond to all requests within 30 days.