# Privacy policy

> How Grand Draws handles your personal data: what we store when you open an account or enter, the cookies we use, who we share it with, and your UK GDPR rights.

Source: https://granddraws.co.uk/privacy

---

# Privacy policy

Last updated: 25 September 2026 (draft)

This policy explains what personal data Grand Draws collects, why we collect it, who we share it with and the rights you have over it. It is written in plain English on purpose. If anything is unclear, ask us at [hello@granddraws.co.uk](mailto:hello@granddraws.co.uk) and we will give you a straight answer.

## The short version

This is a summary to help you get your bearings. The full policy below is what applies.

- When you create an account we collect your **email address, date of birth and marketing choice**. You can add more in your account settings (name, phone, address, notification preferences) and you choose whether to.
- **Our website never stores card or bank details.** When entries open, payments will be handled by a specialist payment processor, so full card details never touch our systems.
- **Nothing non-essential loads before you choose.** Analytics and advertising tools only run after you press "Accept all" on the cookie banner, and you can change your mind any time using "Cookie settings" in the footer.
- **Marketing email only goes to people who opted in**, and every marketing email will carry an unsubscribe link.
- To keep draws provably fair we **publish entry lists** (ticket number, first name and county) and **winners** (first name, county and winning ticket number).
- **We never sell your data.**
- You can ask to see, correct or delete your data at any time, and you can complain to the [ICO](https://ico.org.uk).
- Grand Draws is **18+ only**. We do not knowingly hold data on anyone under 18, and we delete under-18 accounts.

## 1. Who we are and how to contact us

Grand Draws (https://granddraws.co.uk) is a UK skill-based prize competition site run by **HDCH Limited**, trading as Grand Draws, a company registered in England and Wales (company number 16237398), with its registered office at Unit 12 Yeomanry Road, Battlefield Enterprise Park, Shrewsbury, Shropshire, SY1 3EH, United Kingdom. HDCH Limited is the **data controller** for the personal data described in this policy.

We will register with the Information Commissioner's Office (ICO) before paid entries open, and we will publish our registration number here once it is issued.

For anything about your data, email [hello@granddraws.co.uk](mailto:hello@granddraws.co.uk) or use the [contact page](https://granddraws.co.uk/contact).

## 2. What we collect and where it comes from

We only collect what the service actually needs. Here is the full picture, by source.

### Your account

- **Email address and password.** Your password is stored only as a secure hash by our authentication provider (Supabase); we never see or store the password itself.
- **Date of birth.** Used to check you are 18 or over. Accounts that fail this check are refused.
- **Your marketing choice.** Whether you ticked the marketing box, with the date, time and place you made the choice, so we can evidence it.
- **Referral code.** If you arrived through a friend's invite link, the code that credited them is attached to your account at sign-up.
- **Sign in with Google or Apple.** If you use these (where offered), the provider confirms who you are and shares your email address with us. We never receive your Google or Apple password.
- **Meta lead forms.** If you ask to join through a form on Facebook or Instagram (where offered), Meta and our automation provider Zapier pass us the details you submitted there, currently your email address, so we can create the account you asked for and send you a sign-in link.

### Profile details you add

In your account settings you can add your first and last name, phone number, address and notification preferences (which kinds of message you want from us). These are held on your account profile. Name and address become required before we can pay you a prize, because we verify winners and our paid competitions are open to residents of Great Britain only; until then they are optional.

### Entries and competition activity

- The competitions and free draws you enter (such as our free launch draw) and your entry or ticket numbers. Once paid entries open, also your skill-question answers, order history and how you paid (as a reference from the payment processor, never card details).
- Free postal entries: everything you write on the postcard, which our [free entry route](https://granddraws.co.uk/free-entry) asks for: full name, date of birth, address, email, contact number, the competition name and your answer to the skill question. Postal entries join the same entry list as paid entries, with the same odds.

### Rewards activity

The rewards layer (XP, levels, streaks, seasons, wheel spins and the welcome wheel) runs on our server against your account. We record your XP and level, your daily check-in streak, season progress, the rewards you claim and the outcome of each spin. Outcomes are decided and stored server-side so they cannot be tampered with, and the wheel's odds are published on the site.

### If you win

- **Verification.** Before a first payout we confirm your identity and that you are 18 or over and resident in Great Britain. We may ask for proof, such as photo ID.
- **Payout.** Cash prizes are paid by bank transfer to an account in your name. We use your bank details to make the transfer; our website systems never store card or bank details. Winner bank details are collected only when a prize is being paid, are used solely to make that payment, are visible only to the person making it, and are deleted once the payment has cleared and the statutory accounting record has been made.
- **Publicity.** See "What we publish" below.

### What we publish, so draws stay checkable

- **Entry lists.** When a competition closes, the full entry list publishes at that competition's entries page: every ticket number with a first name and county. No surnames and no contact details are ever included.
- **Winners.** Winners appear on our [winners page](https://granddraws.co.uk/winners) with first name, county and winning ticket number, and are contacted directly after the draw. Results can be verified independently at [/draw-check](https://granddraws.co.uk/draw-check).

### Device data and analytics (only after you accept)

- With your consent, Google Analytics, Microsoft Clarity and the Meta Pixel collect device and usage data (pages viewed, clicks, approximate location from your IP, device type) as described in section 5.
- Our own analytics events are deliberately stripped of personal data before they leave your browser: a filter removes emails, names and anything that looks like either. Signed-in activity is linked by a random account ID, never your email address, and only with your consent.
- **First-touch attribution.** With your consent, we store on your device where your first visit came from: campaign tags in the address (utm parameters), advertising click IDs (fbclid, gclid, ttclid), the referring site, the landing page and the date. Without consent this is never stored.
- **Where your account came from.** When you create an account we record the source that brought you to us, for example a search engine, an AI assistant, a social post or one of our own emails. We take it from the first-touch record above if you consented to it, and otherwise from the page address and the referring site at the moment you sign up, which we read and send with the form without storing anything on your device. We keep a short readable label such as "Google organic" alongside the campaign tags, the referring site and the page you landed on, attached to your account. We do this on the basis of our legitimate interests in understanding which channels bring people to us so we can spend our marketing budget sensibly; it is not used to make any decision about you, and you can object to it at any time (section 9).

### Notifications, messages and logs

- **Push notifications.** If you tap "notify me" and allow notifications, your browser gives us a push subscription (a delivery address plus technical keys) which we store together with the topic you subscribed to and your browser type. Opting out deletes it.
- **Messages you send us.** When you contact us we receive whatever you include, normally your email address and your message.
- **Technical logs.** Our hosting and database providers (Cloudflare and Supabase) keep short-lived technical logs, including IP addresses, to run and secure the service.

## 3. Why we use your data, and our lawful bases

UK GDPR requires a lawful basis for each use. Ours are these, named honestly.

- **Contract** (we need it to provide what you asked for): creating and running your account, taking and recording entries, running draws, operating the rewards you claim, contacting you about your entries and results, paying winners, and handling your support requests.
- **Consent** (you choose, and can change your mind): marketing email, analytics and advertising cookies, first-touch attribution, and push notifications. Withdrawing consent is as easy as giving it; section 9 explains how.
- **Legitimate interests** (things any careful operator must do, which we judge do not override your rights): preventing fraud and abuse, for example enforcing one reward claim per account, blocking farmed or self-referred accounts and rate-limiting attacks; keeping our own internal record of sign-ups so we can run the service and support you (see Airtable and Brevo in section 6); publishing entry lists and winner details in the limited form above, so anyone can verify our draws are real and fair; and securing the site. You can object to processing based on legitimate interests (section 9).
- **Legal obligation:** verifying a winner's age and identity before payout, keeping accounting and tax records, and responding to lawful requests from authorities. For verifying a winner and paying them we rely on contract, because we cannot pay a prize without it. For publishing a winner's first name, county and ticket number we rely on legitimate interests, because an unverifiable winners list is worth nothing to anyone deciding whether to trust a competition. You can object to that publication and we will honour it.

## 4. Marketing emails

Email marketing has not started yet. It will begin soon, sent through Brevo, our email provider. When it does, these rules apply and they will not change:

- **Opt-in only.** We only send marketing to people who ticked the marketing box. The box is never pre-ticked, and ticking it is never a condition of creating an account, claiming the welcome gift or entering a competition.
- **Evidenced.** We record when and where you opted in, so your choice is provable.
- **Easy to stop.** Every marketing email will carry an unsubscribe link that works in one click. You can also manage your preferences in your account settings, or just email us.
- **PECR applies.** We follow the Privacy and Electronic Communications Regulations 2003 as well as UK GDPR.
- **Never shared for others' marketing.** We do not give or sell your email address to other companies for their marketing.

Service messages about your account or your entries (for example a winner notification or an entry confirmation) are not marketing and are sent to everyone they affect.

## 5. Cookies and similar technology

We use cookies and browser storage in two strictly separated groups: essential things the site cannot work without, and optional analytics and advertising tools that **only load after you press "Accept all"**. Before you choose, and if you press "Reject all", none of the optional tools load and no optional cookie or storage is set. The banner's two buttons are the same size and both one click, on purpose.

You can change your mind at any time: the **"Cookie settings"** link in the footer reopens the banner, and rejecting after accepting stops the tools recording. If we materially change what these tools do, the banner will ask everyone again.

### Essential storage (always on)

| Name | What it does | How long |
| --- | --- | --- |
| pa_consent_v1 | Remembers your cookie choice and when you made it, so we do not ask on every page. | Until you clear it |
| sb-…-auth-token | Keeps you signed in to your account (set by Supabase). | Until you sign out or it expires |
| gd_spend_limit / gd_self_excluded | Your play-safely settings (monthly spend limit, self-exclusion request). Saved on this device for now; they become account-enforced at launch. | Until you clear or change them |
| gd_ref_v1 | The referral code from a friend's invite link, held so the right person is credited when you sign up. | Until you sign up or clear it |
| pa_seen_welcome_v2 | Remembers the welcome wheel has already been shown, so it does not pop up again. | Until you clear it |
| Offline cache | Stores static files (styles, fonts, images) on your device for speed and offline use. Never your account data or live prices. | Replaced as the site updates |

We treat these as strictly necessary or as functionality you have asked for under PECR.

### Optional tools (only after "Accept all")

| Tool | Who | What it does | Typical cookies |
| --- | --- | --- | --- |
| Google Analytics 4 | Google | Aggregate usage statistics: which pages are visited, from where, on what devices. | _ga , _ga_… (about 2 years) |
| Google Tag Manager | Google | Loads and manages the measurement tags above. It does not itself run analytics. | None of its own in normal use |
| Microsoft Clarity | Microsoft | Records how pages are used (clicks, scrolling, movement) as session replays and heatmaps, to find usability problems. | _clck (about 1 year), _clsk (about 1 day) |
| Meta Pixel | Meta | Measures whether our ads on Facebook and Instagram lead to visits and sign-ups. | _fbp (about 3 months) |
| First-touch attribution | Us | Stores where your first visit came from ( pa_attrib_v1 , described in section 2). | On your device until cleared |

Cookie lifetimes for third-party tools are set by those providers and can change; their own policies are the definitive list. We use Google "Consent Mode v2", which tells Google tools that every optional signal is denied until you say otherwise.

## 6. Who we share your data with

We share personal data only with the providers we need to run the service, each under a data-processing agreement, plus the standard legal cases below. The current list, with locations and safeguards, is kept on our [sub-processors page](https://granddraws.co.uk/sub-processors). We never sell your data.

- **Supabase** hosts our database and sign-in system (EU hosted): accounts, profiles, rewards activity, push subscriptions and, once entries open, entries and orders.
- **Cloudflare** hosts the site and runs our edge security and the small server functions behind features like rewards and sign-up notifications.
- **Google** provides Google Analytics 4 and Google Tag Manager (consent-gated, section 5).
- **Microsoft** provides Clarity (consent-gated, section 5).
- **Airtable** holds our internal customer list: when you create an account, your email, account ID, sign-up date, marketing-consent status (with date and source) and referral code are mirrored to it so our team can see and support sign-ups without opening the database.
- **Brevo** is our email provider. Today it sends us an internal alert when a new account is created (the alert contains your email address). When marketing starts, Brevo will send those emails too (section 4).
- **Meta.** With your cookie consent, the Meta Pixel reports visits and sign-ups from our ads (section 5). We may also confirm sign-ups to Meta server-side for ad measurement, sending only a hashed (scrambled) version of your email so the two reports can be de-duplicated. Server-side conversion events are only sent where you have accepted marketing cookies, and the setting is being aligned so that the server side follows the same choice as the banner.
- **Our payment provider**, named here before paid entries open. When paid entries open, a specialist competition-friendly payment processor will take payments. It will handle all card data itself, under its own PCI DSS compliance, so full card details never reach our systems. We will also list it on the sub-processors page.
- **Authorities and advisers.** We share data where the law requires it (for example with HMRC or under a court order) and, under confidentiality, with professional advisers such as accountants, insurers and lawyers. If the business is ever sold or restructured, data may transfer to the new operator under this same policy.

One transparency note: the [draw checker](https://granddraws.co.uk/draw-check) in your browser fetches the public randomness beacon directly from the drand network to verify results. That request sends no account data, only the ordinary technical details of any web request.

## 7. International transfers

We keep data in the UK and EU where we can: our database and sign-in system are EU hosted, and our email provider is EU based. Some providers process data in the United States or on global infrastructure: Google, Microsoft, Meta, Airtable and Cloudflare.

Where personal data leaves the UK we rely on the safeguards UK GDPR allows: the UK Extension to the EU-US Data Privacy Framework for US providers certified under it, and otherwise the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with each provider's data-processing agreement. The mechanism relied on for each provider is listed on the sub-processors page and is kept in step with it.

## 8. How long we keep your data

We keep data only as long as its purpose needs, then delete or anonymise it. These are our proposed periods.

| Data | Proposed period | Why |
| --- | --- | --- |
| Account and profile (including rewards history and the CRM mirror) | While your account is open, then up to 12 months after closure | Reopening requests, disputes, winding down cleanly |
| Entries, orders, winner and payment records | 6 years after the competition or transaction | Tax and accounting rules, and defending legal claims |
| Postal entries (the physical card and its transcription) | 12 months after the draw result is final | Evidence if an entry or result is disputed |
| Consent and unsubscribe records | For as long as needed to evidence or honour the choice | An unsubscribe is kept as a suppression record so we never email you again |
| Published entry lists and winner results | Retained as the public draw record | Ongoing verifiability of past draws |
| Push subscriptions | Until you opt out or the subscription expires | They only exist to deliver what you asked for |
| Analytics data (consent-based) | Per the configured tool retention (proposed 14 months in GA4) | Trends need history; nothing needs it forever |
| Technical logs | Short provider-controlled windows | Security and debugging only |

## 9. Your rights

Under UK GDPR you have the right to:

- **Access** a copy of the personal data we hold about you.
- **Correct** anything inaccurate or incomplete.
- **Delete** your data ("right to erasure"), where no legal duty requires us to keep it. Entry and payment records, for example, must be kept for the periods in section 8; we will always tell you what we are keeping and why.
- **Restrict** how we use your data while a question about it is resolved.
- **Port** the data you gave us to another service in a machine-readable format.
- **Object** to processing based on legitimate interests, and to direct marketing. An objection to direct marketing is absolute: we stop, full stop.
- **Withdraw consent** at any time, as easily as you gave it: unsubscribe links or account settings for marketing, "Cookie settings" in the footer for cookies and analytics, your browser or device settings (or the same button you used to subscribe) for push notifications. Withdrawing does not affect what was lawfully done before.
- **Not be subject to solely automated decisions** with legal or similarly significant effects. We do not make any. Winners are selected by a verifiably random draw among all entries, published and checkable at [/draw-check](https://granddraws.co.uk/draw-check); reward outcomes use published odds.

To use any right, email [hello@granddraws.co.uk](mailto:hello@granddraws.co.uk) or use the [contact page](https://granddraws.co.uk/contact). It is free, we may need to verify it is really you, and we will respond within one month (extendable for complex requests, and we will say so if so). Until self-serve account deletion is built, account deletion works the same way: ask, and we delete everything the law does not require us to keep.

## 10. Under 18s

Grand Draws is for adults. You must be 18 or over to create an account or enter, and we ask for your date of birth at sign-up to check. We do not knowingly collect data from anyone under 18. If we learn an account belongs to someone under 18 we delete the account and its data, and winners are age-verified before any payout, so an under-18 entry cannot be paid. If you believe someone under 18 has created an account, tell us at [hello@granddraws.co.uk](mailto:hello@granddraws.co.uk) and we will act on it.

## 11. How we protect your data

- The whole site runs over encrypted connections (HTTPS), behind Cloudflare's edge security (firewall, DDoS and bot protection).
- Database access rules mean a signed-in account can read only its own data, and nothing can award itself rewards: every change goes through our server, which holds the keys.
- Passwords are stored only as secure hashes by our authentication provider. We cannot read them.
- Our website systems never store card or bank details.
- Secrets and admin keys live server-side, never in the pages your browser downloads.

No system on the internet can honestly promise perfect security, so we do not. If a breach ever puts your rights at risk we will report it to the ICO within 72 hours where required, and tell you without undue delay if the risk to you is high.

## 12. Complaints and the ICO

If you are unhappy with how we have handled your data, please give us the chance to put it right first: [hello@granddraws.co.uk](mailto:hello@granddraws.co.uk), or our [complaints procedure](https://granddraws.co.uk/complaints) (acknowledgement within 2 working days, full answer within 10). You also have the right to complain at any time to the UK's data protection regulator, the Information Commissioner's Office, at [ico.org.uk](https://ico.org.uk).

## 13. Changes to this policy

We will update this page as the service grows (for example when the payment processor is chosen or marketing email begins) and change the "Last updated" date at the top. If we materially change what our cookies or analytics tools do, the cookie banner will ask for your choice again. Once we can email account holders, we will notify you of significant changes rather than relying on you re-reading this page.

*This notice describes what the site actually does with your data. We will publish our ICO registration number here before the site accepts paid entries.*