Version 2.0 · May 2026
Privacy Policy
How AlphaDraw collects, uses, and protects your personal data under UK GDPR.
In short
- Controller: AlphaDraw — UK prize competition platform
- We collect account, eligibility, skill play, payment, and technical data to run competitions — we do not sell your data
- Third parties are described by category (hosting, payments, SMS, email) — not a public vendor list
- Marketing emails/SMS only with your consent; withdraw anytime in account settings
- Your rights: access, export, correction, erasure, and complaint to the ICO
- Questions or requests: info@alphadraw.co.uk
Version: 2.0 Last updated: May 2026 Controller: AlphaDraw (UK prize competition platform)
This policy explains how we collect, use, store, and share personal data when you use alphadraw.co.uk and related services. We process data in accordance with UK GDPR and the Data Protection Act 2018.
Important: This document is provided for transparency. It is not legal advice. Have your own counsel review before relying on it for regulatory filings.
Who we are
Data controller: AlphaDraw Contact: info@alphadraw.co.uk Supervisory authority: Information Commissioner's Office (ICO) — ico.org.uk
Personal data we collect
| Category | Examples | When |
|---|---|---|
| Account | Email, password hash, name, UK postcode | Sign-up, account settings |
| Identity & eligibility | UK residency declaration, age confirmation, phone (E.164), verification timestamps | Sign-up, skill entry |
| Free postal entry | Name, address, answer to skill question, processing outcome | Postcard / letter entries |
| Transactions | Order totals, payment reference IDs, ticket quantities | Checkout |
| Technical | IP-derived country, session cookies, consent records | Site use |
| Communications | Marketing opt-in/out, notification history | With consent or for service messages |
| Favourites | Competition IDs you watch | Account feature |
We do not knowingly collect data from anyone under 18.
How we use your data
- Run competitions — entries, draws, winner contact (contract / legitimate interests)
- Verify eligibility — UK 18+ and fraud prevention (legitimate interests / legal obligation)
- Payments — process ticket purchases via our regulated payment partner (contract)
- Security — authentication, abuse prevention (legitimate interests)
- Marketing — emails/SMS about draws and offers only with your consent (consent; withdraw anytime)
- Legal compliance — retain audit records where required (legal obligation)
We do not sell your personal data.
Legal bases (UK GDPR Art. 6)
| Purpose | Basis |
|---|---|
| Account & entries | Performance of contract |
| Payments | Contract + legal obligation (financial records) |
| Fraud & integrity | Legitimate interests (balanced against your rights) |
| Marketing | Consent |
| Competition audit / disputes | Legal obligation & legitimate interests |
Data sharing (processors)
We do not sell your personal data. We share it only where needed to run the service, with companies that process data on our instructions (processors) under written terms.
We use the following categories of processors:
| Category | What they do | Typical location |
|---|---|---|
| Cloud infrastructure & hosting | Run the website and application | UK / EEA / US (with safeguards) |
| Database & authentication | Secure accounts, store competition and entry data | UK / EEA / US (with safeguards) |
| Payment processing | Card payments and fraud checks at checkout | UK / EEA |
| SMS verification | One-time codes for UK mobile verification at sign-up | UK / EEA / US (with safeguards) |
| Transactional email | Service messages (e.g. draw updates, winner contact) when enabled | UK / EEA / US (with safeguards) |
Some processors use staff or servers outside the UK. Where personal data is transferred internationally, we rely on UK-approved safeguards (for example the UK International Data Transfer Agreement or equivalent contractual protections).
Named subprocessors: We do not publish a live vendor list on this page. You may request the current list of processor names and contact details by emailing info@alphadraw.co.uk (we respond within one month, same as other data rights).
Retention
| Data | Typical retention |
|---|---|
| Account profile | Until deletion request + completion, or 3 years inactivity |
| Competition & draw audit | Up to 7 years (integrity, tax, disputes) |
| Payment records | As required by UK tax/accounting law |
| Cookie consent logs | 3 years |
| Marketing consent | Until withdrawn + short audit trail |
Your rights
You have the right to:
- Access — know what we hold about you
- Rectification — correct inaccurate data (account page or email us)
- Erasure — request deletion (subject to legal retention)
- Restriction — limit processing in certain cases
- Portability — machine-readable export (Account → Download my data)
- Object — to processing based on legitimate interests
- Withdraw consent — for marketing and non-essential cookies anytime
To exercise rights: info@alphadraw.co.uk or your account privacy settings. We respond within one month.
You may complain to the ICO if you believe we have handled your data unlawfully.
Automated decisions
Skill outcomes are calculated by distance to the judge pin (deterministic rules). We do not use profiling that produces legal or similarly significant effects without human review.
Security
We use encryption in transit (HTTPS), row-level database security, least-privilege admin access, and audit logging for sensitive operations.
Changes
We will update this policy when practices change. Material changes will be notified on-site or by email. Version history is stored in our legal document register.
Terms and Conditions · Cookie Policy · Account privacy settings · Competitions