🎉 £500 Cash Opening Competition is now open — entries from £2.50, free postal route available.

Privacy policy

How we collect, use, share and protect your personal data, and the rights you have over it.

This policy is issued by WINTHEWEEKOFFICIAL LTD (company number 17328588), registered office 5th Floor, 167-169 Great Portland Street, London, W1W 5PF. We are the data controller for the personal data described here. Questions and requests: hello@wintheweekcomps.com. Last updated 8 September 2026.

1. What we collect

Account details: name, email address, date of birth, UK residential address, password (stored only as a secure hash by our authentication provider), and your marketing choices.
Entries and orders: which competitions you entered, how many entries, the ticket numbers issued, what you paid, any discount or site credit used, and refunds.
Postal entries: the name, address and details written on the card, recorded by our team against the competition.
Membership details: if you join a members-only group (for example NHS, Armed Forces, offshore workers), the group and any verification detail you give us.
Winner details: if you win, the identity and address information needed to verify you and deliver the prize, and a photo if you agree to one.
Responsible-play settings: spending limits, time-outs and self-exclusion, and the records needed to enforce them.
Technical data: your IP address (used briefly to limit repeated sign-in and entry attempts), browser and device type, the pages that error, and the cookies described in our Cookie Policy.
App alerts: if you turn on alerts in our iPhone app, a push token that lets Apple deliver our notifications to that phone. It identifies the phone, not you, and is linked to your account only so the right alerts reach you.
Messages: emails you send to hello@ or complaints@, and our replies.

We never see or store your card number. Card payments are taken on a page hosted by our payment provider.

2. Why we use it, and the legal basis

Purpose	Legal basis (UK GDPR Art. 6)
Running your account, taking entries and payments, issuing tickets, running the draw and contacting winners	Contract with you
Checking you are 18 or over and UK resident, verifying winners, keeping the fairness record of every draw	Legal obligation, and our legitimate interest in running lawful, provably fair competitions
Responsible-play tools, and preventing fraud, multiple accounts and misuse	Legitimate interests, and legal obligation
Keeping financial records	Legal obligation (tax and company law)
Emails and notifications about new competitions	Consent, which you can withdraw at any time
Essential service emails and app notifications (confirmations, results, refunds, account security)	Contract with you
Fixing errors and keeping the site secure	Legitimate interests
Publishing a winner's first name and surname initial	Legitimate interest in transparency; anything more only with consent

We do not use automated decision-making or profiling about you. Winners are chosen by a published, verifiable method described on each competition page, not by anything about the entrant.

3. Who we share it with

We use a small number of service providers who process data on our instructions under written contracts:

Supabase — database and sign-in, hosted in London, UK.
Vercel — website hosting and delivery. Vercel operates in the UK, EU and US; transfers outside the UK are covered by the UK International Data Transfer Addendum to the EU standard contractual clauses.
Cashflows — card payments, UK. Cashflows receives your email address and the amount so it can take the payment and send you a card receipt.
Resend — sending and receiving our email, on servers in the EU (Ireland).
Sentry — error monitoring, on servers in the EU (Germany). Personal details are stripped from error reports before they are sent.
Apple — delivers notifications to our iPhone app through the Apple Push Notification service, only if you turn alerts on. Apple receives the push token and the words of the notification, nothing else about you.

We also share data when the law requires it, for example with HMRC, a court, or a regulator, and with our professional advisers under confidentiality. We never sell personal data.

4. How long we keep it

Data	Kept for
Account profile (name, address, contact details, preferences)	While your account is open, then removed or anonymised when you ask us to delete it, or after 6 years of no activity
Orders, payments, refunds, credit and entries, including the draw fairness record	6 years from the transaction, to meet UK financial record-keeping rules. Kept in restricted form after your account is deleted
Date of birth	With the transaction records above, as evidence of age eligibility
Self-exclusion and responsible-play records	For as long as needed to honour the exclusion, then with the records above
Marketing consent	Until you withdraw it. We keep a record that you withdrew
App push token	Until you turn alerts off, delete the app, or close your account, whichever comes first
Winner verification and prize delivery details	6 years from the draw
Technical logs, error reports and rate-limit records	Up to 90 days
Emails to and from us	Up to 2 years, or longer while a complaint or dispute is open

5. Your rights

Under UK GDPR you can ask us to:

Access the personal data we hold about you, and receive a copy.
Correct anything inaccurate. You can change most details in your account settings.
Delete your data. Our delete your account page explains how, what is removed, and what we must keep.
Restrict or object to processing based on our legitimate interests.
Port the data you gave us to another service in a machine-readable form.
Withdraw consent to marketing at any time, using the link in any message or your account settings. This does not affect anything done before you withdrew.

To exercise any right, email hello@wintheweekcomps.com from the address registered on your account. We respond within one month. We will not charge you unless a request is clearly unfounded or excessive.

6. Complaints

If you are unhappy with how we handle your data, email complaints@wintheweekcomps.com and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

7. Security

Data is encrypted in transit and at rest. Access to customer data is limited to the people who need it to run the service, and every administrative action on a competition is recorded in an audit log that cannot be altered. Passwords are never stored in readable form.

8. Children

This service is for people aged 18 and over. We ask for a date of birth at sign-up and refuse accounts for anyone under 18. If you believe a child has given us personal data, tell us and we will delete it.

9. Changes

If we change this policy in a way that affects you, we will tell you by email or a notice on the site before the change takes effect. The date at the top shows the current version.