Privacy Policy

1.1 When you create an Account or enter through the Paid Route

• Identity: first and last name, date of birth, and (for prize verification) a copy of a government-issued photo ID.
• Contact: email, postal address, and phone number (optional).
• Payment: billing address and card information. Card details go to our payment provider (Acquired.com) under their terms and aren't stored on our systems.
• Entry data: the Competition, number of tickets, the time and method of Entry, and your unique entry numbers.

1.2 When you enter through the Free Entry Route

• What you've written on your postcard: full legal name, postal address, email (if given), phone (if given), date of birth, and the named Competition.
• The fact we received a valid Entry from you, and the unique entry number.
• No payment data — there's nothing to pay.

1.3 When you use the site

• Technical: device type, browser type, operating system, broad geographic location from request headers. Your originating IP is processed transiently for security and rate limiting and isn't persisted in our database.
• Account preferences: communication choices, the personal spend cap you've set, and any time-out or self-exclusion.

1.4 When you contact us

The content of your message, the channel you used, and our reply. We don't record calls.

1.5 When you win a Competition

• What we need to verify your identity and release each gift card issuance through the aggregator.
• If you give written consent, a photo, video or testimonial for publicity.

• Directly from you — when you set up an Account, enter through either route, contact us, or reply to a marketing communication.
• From your device automatically — when you use the site.
• From our service providers — when they process payments, scrutineer postal entries, run random draws, issue gift cards, verify your identity, or deliver email on our behalf.

Purpose: running Competitions and awarding Prizes (both routes)

Processing Entries, running Draws, contacting Potential Winners, verifying identity, issuing gift cards through the aggregator, and providing customer support.

Lawful basis: performance of the contract between you and us. By submitting a postal Entry or paid Entry, you enter that contract.

Purpose: managing your Account

Lawful basis: performance of the contract; legitimate interest in operating a secure account system.

Purpose: legal and regulatory compliance

Record-keeping for tax, regulatory disclosure, anti-money laundering and sanctions checks, and lawful requests from regulators or law enforcement.

Lawful basis: compliance with a legal obligation.

Purpose: protecting the integrity of the site and the Competitions

Fraud prevention, detection of multiple Accounts or automated entry, payment-card abuse, duplicate postal entries, and enforcement of our terms.

Lawful basis: legitimate interest in protecting the site, our customers, and the fairness of the Draws.

Purpose: transactional emails

Order confirmations, postal entry receipt confirmations (where a postcard included an email), draw reminders, winner notifications, service announcements.

Lawful basis: performance of the contract.

Purpose: marketing emails about future Competitions

Lawful basis: your consent when you sign up or enter; or, for existing customers who haven't opted out, our legitimate interest under the soft opt-in in regulation 22(3) of PECR. You can opt out any time.

Purpose: improving the site and our service

Lawful basis: legitimate interest. Plausible Analytics is cookie-less and doesn't collect personal data; Sentry is configured to scrub personal data from error reports.

Because the Free Entry Route involves physical mail, these additional provisions apply:

• Postcards and letters are received by our scrutineer (a UK-based postal entry processor) on our behalf. They transcribe the personal data on each valid postcard into the entry pool, validate it against eligibility criteria, and securely store the originals for the retention period below.
• The scrutineer acts as our data processor under a written contract that meets UK GDPR Article 28 requirements.
• Original postcards are securely retained for 90 days after the Draw, then destroyed, unless we need to keep one longer to defend a claim or evidence the integrity of a Draw to a regulator.
• Transcribed entry data follows the retention schedule in section 7 below.

We won't use postal entry data for marketing unless the entrant separately consents — we'll ask, by reply to the email on the postcard where one is given, before any marketing is sent.

5.1 Our service providers (processors)

• Acquired.com — payment processing.
• Runa (with Tillo as fallback) — gift card issuance for prize fulfilment.
• Resend — transactional and marketing email delivery.
• Vercel — hosting and content delivery. Vercel transmits your originating IP and geolocation headers to our application on every request. We use geolocation to enforce UK-only entry; the IP is processed transiently and not stored in our database.
• MongoDB Atlas — primary database, in the UK / EEA.
• Upstash Redis — rate limiting and ephemeral state.
• Plausible Analytics — cookie-less site analytics, no personal data.
• Sentry — error monitoring, personal data scrubbed.
• A UK-based postal entry scrutineer — receives, validates, transcribes and stores Free Entry Route postcards. Named on the site before the first Draw.
• randomdraws.co.uk (operated by TPAL) — runs the random selection of Winners and produces draw certificates. We upload anonymised entry references only, so the draw provider does not receive or process your personal data; we match the winning reference back to you on our own systems.
• Identity verification — we verify the identity, age and UK residence of Potential Winners ourselves from the documents provided. If we appoint a specialist verification provider, we will name it on the site and in this Policy before any verification is conducted through it.

5.2 Other recipients

• Our professional advisers (lawyers, accountants, auditors), on a need-to-know basis.
• Regulators, courts, and law enforcement where we're legally required.
• A purchaser, investor or successor in a corporate transaction, under appropriate confidentiality.

5.3 Public publication of Winner details

We publish limited Winner information (first name, outward postcode, Competition won). See section 16 of the Consumer Terms and Conditions for the Winner's right to object.

5.4 We don't sell your data

We don't sell your personal data and don't share it with third parties for their own marketing purposes.

Some providers process data outside the UK. Where they do, we protect your data with one of: a UK adequacy decision (including the UK extension to the EU–US Data Privacy Framework where the recipient is certified); the UK International Data Transfer Agreement (IDTA); or the EU Standard Contractual Clauses with the UK Addendum — in each case with a documented transfer risk assessment.

• Acquired.com, Runa, Tillo, postal scrutineer — UK-based.
• randomdraws.co.uk (TPAL) — Australia-based. Because we upload anonymised entry references only, no personal data is transferred to the draw provider. If that ever changes, a transfer safeguard (UK adequacy for Australia does not currently exist; IDTA with a transfer risk assessment) would be put in place first.
• Resend, Vercel, Sentry — US-based. Safeguard: UK extension to the EU–US DPF where certified, or IDTA with TRA.
• MongoDB Atlas, Upstash, Plausible — UK / EEA-based for our use. Safeguard: EEA adequacy or IDTA with TRA.

• Account data, where the Account has never won a Prize — life of the Account plus 12 months after closure.
• Account data, where the Account has won a Prize — life of the Account plus 6 years after closure (HMRC and audit).
• Entry data for non-winning entries (both routes) — 24 months from the end of the Entry Period.
• Entry data and Draw records for the winning Entry — 6 years from the final gift card instalment.
• Original postal entry postcards — 90 days from the Draw, then secure destruction.
• Identity verification documents for confirmed Winners — 6 years from the final gift card instalment.
• Identity verification documents for Potential Winners who don't become Winners — 90 days from conclusion, except to defend a claim.
• Payment and refund records — 6 years from the transaction (HMRC).
• Marketing consent and opt-out records — as long as we hold your contact details, plus 12 months after deletion.
• Complaints records — 6 years from resolution.
• Technical analytics — typically up to 12 months in aggregated form; Plausible holds no personal data.

Under UK GDPR and the Data Protection Act 2018 you have rights to: access, rectification, erasure, restriction of processing, objection to processing (including marketing at any time), data portability, withdrawal of consent, and not to be subject to solely automated decision-making that has legal or similarly significant effects (we don't do this).

To exercise any right, email us at the address in section 13. We'll respond within one month, extendable by up to two further months for complex requests — we'll tell you within the first month if we need longer.

We have technical and organisational measures to protect your data, including encryption in transit and at rest, access controls, logging, and regular review of our providers' security practices. Postal entries are stored in physically secure facilities by our scrutineer.

Our service isn't directed to anyone under 18, and we don't knowingly collect personal data from anyone under 18. We ask everyone to confirm their age at sign-up, at paid entry, and on the postcard for the Free Entry Route. If you believe a person under 18 has given us data, tell us and we'll delete it.

We may update this Policy from time to time. The current version is always on the site with the effective date at the top. If a change is material, we'll notify you by email or by a prominent notice on the site before it takes effect.

You have the right to complain to the Information Commissioner's Office (ICO). We'd appreciate the chance to address your concerns first — see our Complaints Procedure.

Information Commissioner's Office — Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline: 0303 123 1113. Website: ico.org.uk.

Covered Club Ltd

[Registered office address]

Email: hello@joincoveredclub.com