Privacy Policy

Introduction

Welcome to the Privacy Policy of INFINITY COMPETITIONS LTD.

We value your privacy and are committed to protecting your personal information. This Policy explains how we collect, use, store and protect your personal data when you visit or interact with our website infinity-competitions.com (the “Site”), wherever you access it from. It also sets out your privacy rights and the legal protections available under the UK GDPR and the Data Protection Act 2018.

Purpose of this Policy

The purpose is to clearly explain how we collect and process personal information through your use of the Site, including the information you provide when you:

• subscribe to our newsletter or updates;
• purchase tickets for competitions;
• take part in competitions, prize draws or instant-win campaigns;
• send us a free postal entry under Section 4.2 of the Terms and Conditions;
• create an account or contact us through the Site.

Our Site and services are not intended for children and are only available to persons aged 18 or over. We do not knowingly collect personal information relating to anyone under the age of 18. If we learn that we have collected data from a minor, we will delete it without delay and refund any payments made.

This Policy should be read together with any additional privacy notices we may provide on specific occasions.

Data Controller

INFINITY COMPETITIONS LTD is the data controller responsible for your personal information within the meaning of the UK GDPR.

If you have any questions regarding this Privacy Policy, your personal information, or your legal rights, please contact us using the details below.

Updates to this Policy

We may review and update this Policy from time to time to reflect changes in our business practices, legal obligations or services. The most recent version will always be available on the Site.

It is important that the personal information we hold about you remains accurate and up to date. Please let us know promptly if your details change (you can also do this from your account page).

The Site may contain links to external websites, applications or plugins operated by third parties. We do not control these third-party services and are not responsible for their privacy practices. We encourage you to review the privacy policies of any external sites you visit.

The information we collect about you

Personal data means any information capable of identifying a person, whether directly or indirectly. It does not include fully anonymised information.

We may collect, use, store and transfer the following categories of information:

• Identity data — first name, surname, username;
• Contact data — email address, phone number, billing address (street, city, county/region, postcode, country);
• Transaction data — details of tickets purchased, competition entries and payments made;
• Technical data — IP address, browser type, login data, device information, operating system;
• Profile data — account credentials (encrypted password), order history, competition activity, language preferences;
• Usage data — how you interact with the Site, pages visited, session duration;
• Marketing and communication preferences — your choices regarding marketing communications, newsletter subscription/unsubscription.

Payment data

We do not collect or store bank card details directly. Payment processing is securely handled by Cashflows, an FCA-authorised payment institution which acts as an independent controller of payment data under its own privacy policy (available on the Cashflows website).

Data collected through free postal entry

For Participants who choose the free postal entry route (Section 4.2 of the Terms), we collect the information included in the letter sent: full name, date of birth (to verify the minimum age of 18), postal address, email address, phone number, handwritten signature and — where applicable — the answer to the Competition Question. This data is entered into our system solely for the purpose of administering the Competition (allocating the ticket, selecting winners, delivering prizes) and is retained under the conditions described in the “Data retention” section. Original letters are securely archived or destroyed after processing, in accordance with our internal retention policy.

Data we do NOT collect

We do not intentionally collect sensitive personal information, such as:

• racial or ethnic origin;
• religious or philosophical beliefs;
• political opinions;
• health-related information;
• biometric or genetic data;
• trade union membership;
• information about criminal offences.

Where necessary to award a prize or to comply with the law (KYC, anti-fraud checks), we may request additional identification documents from Winners.

If you do not provide information required by law or by contract, we may be unable to provide our services, process purchases or allow you to take part in competitions.

Marketing communications

We may use your identity, contact, profile and usage data to determine which products, competitions or promotions may be relevant to you.

We send marketing communications only to people who have subscribed to our newsletter using the subscription form on the Site. Registering an account, buying tickets or entering a Competition does not add you to our marketing list. You will therefore receive marketing from us only where all of the following apply:

• you have subscribed to our newsletter using the subscription form on the Site;
• the communication concerns our own competitions, offers and winner announcements;
• you have not since unsubscribed — every marketing email contains an unsubscribe link.

We will share your information with third parties for marketing purposes only where you have given your explicit consent.

You can unsubscribe at any time by:

• using the unsubscribe link included in every email communication;
• contacting us directly at contact@infinity-competitions.com.

Please note that opting out of marketing materials does not affect service-related communications (purchase confirmations, win announcements, account activity), which we will continue to send.

Cookies

The Site uses cookies and similar technologies to improve performance, functionality, traffic analysis and the user experience. For full details, see our Cookie Policy.

You can configure your browser settings to reject some or all cookies. Disabling cookies may affect the functionality of the Site (for example, authentication).

Use of your personal information

We use your data only for the purposes for which it was originally collected, unless we reasonably consider that another compatible purpose applies.

The main purposes include:

• creating and administering your account;
• processing competition entries and payments;
• selecting and notifying winners;
• publishing the surname and location details of Winners, and the winning ticket number, to demonstrate that a valid award took place, as required by the UK Advertising Codes (you may object at any time — see the Terms and Conditions);
• publishing, before each draw, the entry list for the relevant Competition — entrant name, ticket number, order number and purchase date — so that every Participant can verify the draw;
• sending service-related communications (confirmations, updates);
• sending marketing communications (with consent);
• preventing fraud and ensuring the security of the Site;
• complying with legal, tax, accounting and regulatory obligations.

If we need to process information for a purpose unrelated to the original reason, we will inform you where this is legally required.

Sharing your information

We may share your data with the following categories of recipients:

• Technology service providers — see “Third-party providers” below;
• Payment processors — Cashflows;
• Professional advisers — accountants, auditors, insurers, lawyers, tax advisers, where necessary for our business;
• Regulatory and law enforcement authorities — where we are legally required (ICO, HMRC, courts and other competent regulatory authorities);
• Potential buyers or successors — in the event of a merger, acquisition or business transfer.

All third parties that process your data on our behalf are contractually required to maintain appropriate security measures and to comply with applicable data protection laws.

Third-party providers we use

• Supabase — authentication and storage of account data (acts as a data processor for us);
• Cashflows — card payment processing (independent controller of payment data);
• MailerSend — sending transactional emails (confirmations, password resets) and newsletters;
• Umami — Site traffic analysis (see the Cookie Policy for details);
• Cloudflare Turnstile — anti-bot verification when creating an account and subscribing to the newsletter; acts as a data processor for us (see the Turnstile Privacy Addendum);
• Hosting provider — we use third-party service providers to host the Site and store data; they apply the data protection law in force regarding international data transfers.

Anti-bot verification (Cloudflare Turnstile)

We use Cloudflare Turnstile to protect the public forms on the Site — account creation and newsletter subscription — against automated sign-ups and abuse. The check runs in the background and, in most cases, requires no action from you. The legal basis is our legitimate interest in preventing fraud and automated abuse of the Site.

To tell real visitors apart from automated programs, Cloudflare receives and analyses technical signals: your IP address, the User-Agent header, your browser's TLS fingerprint, as well as the sitekey and the origin the widget is loaded from. This data is not used for advertising or to track you across websites.

Cloudflare's processing is described in the Turnstile Privacy Addendum, which we incorporate by reference into this policy.

International data transfers

Some third-party providers we use may operate or store data outside the United Kingdom (for example, MailerSend — Lithuania (EEA); Supabase — Ireland (eu-west-1, EEA)). Cashflows is a UK-based payment institution.

When data is transferred internationally, we ensure that an adequate level of protection is maintained, through:

• transfers to jurisdictions with an adequacy decision issued by the UK Government (e.g. the EEA);
• the use of Standard Contractual Clauses approved by the ICO or the International Data Transfer Agreement (IDTA);
• approved security certifications or codes of conduct.

Data security

We implement appropriate technical and organisational security measures designed to protect your personal data against:

• unauthorised access;
• misuse;
• loss;
• unauthorised disclosure;
• alteration;
• destruction.

Access to personal information is limited to authorised personnel and service providers who require access for legitimate business purposes and who are subject to contractual confidentiality obligations.

We maintain procedures for handling suspected personal data breaches. Where legally required, we will notify the ICO within 72 hours of becoming aware of a breach and will inform affected individuals without undue delay.

Data retention

We retain personal information only for as long as is reasonably necessary to fulfil the purposes for which it was collected, including legal, tax, accounting and reporting obligations.

Retention periods vary depending on:

• the type of information;
• legal requirements (for example, accounting records — 6 years under UK law);
• the need to resolve any disputes;
• legitimate business interests.

In certain circumstances, we may anonymise personal information for research, analytical or statistical purposes — anonymised data can no longer identify you and may be used indefinitely.

Your legal rights

Under the UK GDPR and the Data Protection Act 2018, you have the following rights:

• Right of access — to obtain a copy of the data we hold about you;
• Right to rectification — to correct inaccurate information;
• Right to erasure (the “right to be forgotten”) — to request deletion of data in certain circumstances;
• Right to object — to object to certain processing activities;
• Right to restrict processing — in specific cases;
• Right to data portability — to receive your data in a structured, commonly used and machine-readable format;
• Right to withdraw consent — where processing is based on consent;
• Right to lodge a complaint with the supervisory authority — in the UK this is the Information Commissioner’s Office (ICO), ico.org.uk.

To exercise any right, send a request to contact@infinity-competitions.com. Requests may require verification of your identity before processing. We aim to respond to valid requests within one month, although complex requests may require additional time (up to 3 months, with prior notice).

Exercising your rights is free of charge, except for manifestly unfounded or excessive requests, for which we may charge a reasonable fee or refuse them.

Legal basis for processing

We process your personal data on the basis of one or more of the following legal grounds:

• Performance of a contract — to provide our services to you (account registration, ticket processing, prize delivery);
• Your consent — for direct marketing (newsletter subscription), and for any cookies or similar technologies that require consent, should we introduce them;
• Legal obligations — to comply with tax, anti-money-laundering, KYC and reporting obligations;
• Legitimate interests — for security, fraud prevention, service improvement, the publication of the entry list before each draw so that draws can be verified, and the publication of Winner information required by the UK Advertising Codes.

Where processing is based on legitimate interests, we carefully consider and balance any potential impact on your rights and freedoms.

Contact us about privacy

If you have any questions, concerns or requests relating to your personal information or this Policy, please contact INFINITY COMPETITIONS LTD using the contact details provided above.

We will respond in English.