Privacy Policy

Data Controller: Pokey Prizes

Business address: 2 Sambrook Close, Telford, TF3 1RT, United Kingdom

Contact: privacy@pokeyprizes.com

We are registered with the Information Commissioner's Office (ICO) as a data controller. If you have any concerns about how we handle your data, you have the right to contact the ICO at ico.org.uk.

Account data: When you register, we collect your name, username, email address, date of birth, and (optionally) mobile number.

Transaction & competition data: We collect details of entries purchased, payment amounts, order references, and competition entry history.

Delivery data: When claiming a prize, we collect your delivery address and any ID documentation required for verification.

Usage data: We collect standard web server logs, page visit data, device type, and browser information to operate and improve the platform.

Communications data: Records of correspondence with our support team, including emails and contact form submissions.

Responsible play data: Spend limit settings, self-exclusion status, and monthly spending summaries associated with your account.

You may choose to register or sign in using Google or Discord. When you do, we receive limited profile information from that provider:

• Google Sign-In: your name, email address, and profile picture. We do not receive your Google password.
• Discord Sign-In: your Discord username, email address, and avatar. We do not receive your Discord password.

This data is used solely to create and authenticate your Pokey Prizes account. We do not post to your social accounts or access your contacts. Your use of Google Sign-In is also governed by Google's Privacy Policy.

We do not sell, rent, or otherwise disclose your personal data to third parties for their own marketing purposes.

We share your data only with the following categories of third parties, and only to the extent necessary:

• Trust Payments Ltd - our payment processor, which receives your payment card data to process transactions. Trust Payments is authorised by the FCA and processes data under a Data Processing Agreement with us. We do not receive or store your full card number.
• Resend - our transactional email provider, which receives your email address and name to deliver account and competition emails on our behalf.
• Meta Platforms Ireland Ltd - provides advertising measurement through Meta Pixel, but only after you accept optional marketing cookies.
• Royal Mail / courier services - your delivery name and address are shared with our shipping provider solely for prize fulfilment.
• Identity verification providers - for prize claims over £500, we may use a third-party ID verification service. Only the minimum data required for verification is shared.
• Law enforcement and regulators - we may disclose data where required by law, court order, or regulatory requirement.

All third-party processors operate under Data Processing Agreements compliant with UK GDPR.

We retain your account and transaction data for as long as your account is active. After account closure, we retain financial transaction records for 7 years in accordance with HMRC requirements. Other personal data is deleted or anonymised within 30 days of an account closure request, subject to any overriding legal obligation.

Marketing consent preferences are retained for 3 years from your last active engagement, after which we will re-seek consent or suppress your address.

We use industry-standard security measures to protect your data, including TLS encryption in transit, hashed and salted password storage, access controls, and regular security reviews. Payment card data is handled exclusively by our PCI-DSS compliant payment processor and is never stored on our servers.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO in accordance with our UK GDPR obligations.

We use essential cookies to keep you logged in and to protect against fraud. With your consent, we may also use optional analytics and marketing cookies to understand site usage and measure advertising. For full details, see our Cookie Policy.

Our servers and primary data processors are located in the United Kingdom or European Economic Area. Where any data is transferred outside the UK, we ensure appropriate safeguards are in place (such as the UK's International Data Transfer Agreement or adequacy decisions). If you would like details of any specific transfer mechanisms, contact us at privacy@pokeyprizes.com.

You have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you;
• Rectification: correct inaccurate or incomplete data;
• Erasure: request deletion of your data (subject to legal retention obligations);
• Restriction: ask us to pause processing in certain circumstances;
• Portability: receive your data in a structured, machine-readable format;
• Objection: object to processing based on legitimate interests; and
• Withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, visit Account Settings → Privacy or email privacy@pokeyprizes.com. We will respond within 30 days. If you are dissatisfied with our response, you may complain to the ICO at ico.org.uk.

We may update this Privacy Policy from time to time. Material changes will be communicated by email before they take effect. The current version is always available at pokeyprizes.com/privacy.