Privacy Policy

Version 1.0 · Last updated 21 September 2026

This policy explains what personal data A1 Competitions Limited collects when you use our website and enter our competitions, why we collect it, who we share it with and what your rights are.

1. Who is responsible for your data

A1 Competitions Limited (company number SC880484, registered office The Roost Cottage, Maryculter, Aberdeen, AB12 5GT) is the data controller. We are registered with the Information Commissioner's Office.

Contact us about your data at [email protected] or by post at A1 Competitions Limited, Maryculter Organic Farm, Maryculter, Aberdeen, AB12 5GT.

2. What we collect

• Account details: name, email address, date of birth, telephone number, postal address, password (stored in hashed form by our platform).
• Entry and order details: the competitions you enter, ticket numbers, order history, wallet balance and transactions, postal entries.
• Payment details: payments are taken by our payment provider, Cashflows. We receive confirmation of payment, the card type and the last four digits only. We never see or store your full card number.
• Winner verification: where you win, copies of identity, age or address documents you provide, and the bank details you give us for a cash prize.
• Player protection: spending limits, timeouts and any protective measures on your account.
• Communications: emails, messages and calls with our team, including complaints.
• Technical and usage data: IP address, device and browser information, pages visited, referral source, and the cookies described in section 8.
• Marketing preferences: whether you have agreed to receive marketing and by which channel.

We do not knowingly collect data from anyone under 18. Our competitions are for adults only.

3. Why we use it and our legal basis

• Creating and running your account, allocating tickets, running draws, paying prizes — Performance of our contract with you
• Verifying your age, identity and address — Legal obligation and our legitimate interest in running lawful, fair competitions
• Taking payment and preventing fraud — Contract; legitimate interest in preventing fraud and misuse
• Publishing winners (first name, surname initial, town) — Legitimate interest in showing competitions are genuine; photos and video with your consent only
• Player protection tools and behaviour monitoring — Legitimate interest in preventing harm; your request where you set a limit
• Sending you marketing by email or SMS — Your consent, which you can withdraw at any time
• Service emails (order confirmations, draw results, account notices) — Contract
• Handling complaints and disputes — Contract; legal obligation
• Keeping financial records — Legal obligation
• Improving the website and understanding how it is used — Legitimate interest; consent where cookies require it

4. Who we share it with

We share personal data only with the organisations that help us run the business, and only what they need:

• RaffleX, the platform that hosts our website, accounts, orders and draws.
• Cashflows, our payment processor.
• TrueNorth, the certified random number generator used for our draws (ticket numbers only).
• Cloudflare, which provides security and content delivery for the website.
• Klaviyo and Brevo, which send our marketing and service emails and SMS where you have agreed to receive them.
• Meta (Facebook and Instagram) and Google, for advertising measurement and analytics, where the related cookies are active (see section 8).
• Trustpilot, to invite you to review us after a purchase, where we use that service.
• Delivery companies and prize suppliers, so that prizes can be delivered.
• Our accountants, legal advisers, insurers and, where required, HMRC, regulators, the police or a court.

We do not sell your personal data. Some of these providers process data outside the UK; where they do, transfers are protected by the UK International Data Transfer Agreement, UK adequacy regulations or equivalent safeguards.

5. How long we keep it

• Account data: for as long as your account is open, then 12 months, unless we need it longer for the reasons below.
• Order, payment, prize and winner records: 6 years after the transaction, to meet tax and legal record-keeping requirements.
• Winner verification documents: 12 months after the prize is paid, then deleted.
• Player protection records: for the life of the account and 12 months after closure, so that limits and timeouts are respected.
• Marketing preferences: until you withdraw consent, and then a record that you did so.

6. Your rights

You have the right to ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, to move it to another provider, and to withdraw consent at any time. Email [email protected] and we will respond within one month. You can also complain to the ICO at ico.org.uk or on 0303 123 1113, though we would welcome the chance to help first.

Some rights are limited where we must keep data by law, for example order records, or where deleting it would prevent us honouring a timeout or limit you have set.

7. Marketing

We only send marketing emails and texts if you have opted in. Every message includes an unsubscribe link, and you can change your preferences in your account or by emailing us. Opting out of marketing does not stop service emails such as order confirmations and draw results.

8. Cookies

Cookies are small files placed on your device. We use them as follows.

• Essential — session, security and basket cookies set by the RaffleX platform; Cloudflare security cookies (__cf_bm, cf_clearance) — Keep you signed in, protect the site and remember your basket. The site does not work without them.
• Analytics — Google Analytics (_ga, _ga_*) — Understand how the site is used so we can improve it.
• Marketing — Meta Pixel (_fbp), Klaviyo (__kla_id), Brevo tracking — Measure our advertising and personalise messages you have agreed to receive.

You can block or delete cookies in your browser settings; blocking essential cookies will stop parts of the site working. Where a cookie banner is shown, you can change your choices there at any time.

9. Security

Your account is protected by a password and, on the platform, by encryption in transit and at rest. Please keep your password private and tell us straight away if you think your account has been accessed by someone else.

10. Changes

We will post any changes to this policy on this page and, where the change is significant, tell you by email. This policy was last updated on 21 September 2026.