Privacy Policy
Last updated: May 2026
Who We Are
KD Competitions is a UK-based prize competition operator. We operate the website kdcompetitions.co.uk.
Data Controller: KD Competitions Contact Email: info@kdcompetitions.co.uk Website: kdcompetitions.co.uk
Registered Office: KD Competitions, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Registered in: England and Wales (17243787)
For the purposes of UK data protection law, KD Competitions is the data controller responsible for your personal data.
Our Commitment to Your Privacy
We are committed to protecting your privacy and handling your personal data transparently and lawfully. This policy explains what data we collect, why we collect it, how we use it and your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
Please read this policy carefully. By using our website and services you acknowledge that you have read and understood this policy.
What Personal Data We Collect
We may collect and process the following categories of personal data:
Identity Data
- Full name
- Date of birth
- Username or similar identifier
Contact Data
- Email address
- Phone number
- Home address including postcode
Transaction Data
- Details of ticket purchases and competitions entered
- Payment information (processed securely — we never store full card details)
- Order history and receipts
Technical Data
- IP address
- Browser type and version
- Device type and operating system
- Pages visited and time spent on site
- Referring website
- Cookie identifiers
Profile Data
- Account login details
- Competition entry history
- Preferences and settings
- Communications with us
Marketing Data
- Preferences for receiving marketing communications
- Consent records and timestamps
- Consent granularity per channel (email, SMS) in line with the Data (Use and Access) Act 2025
Responsible Play Data
- Spend limits set
- Self-exclusion requests
- Break requests
- Account suspension records
How We Collect Your Personal Data
We collect personal data through the following means:
Directly from you when you:
- Create an account on our website
- Purchase competition tickets
- Submit a contact or enquiry form
- Sign up to our newsletter
- Enter by post
- Request responsible play tools
- Communicate with us by email or phone
Automatically when you:
- Browse our website (via cookies and similar technologies)
- Use our mobile or desktop site
From third parties including:
- Payment processors (Shopify Payments, PayPal)
- Analytics providers (Google Analytics)
- Social media platforms if you interact with our content
Why We Use Your Personal Data — Lawful Basis
Under UK GDPR we must have a lawful basis for processing your personal data. The table below explains how and why we use your data:
| Purpose | Data Used | Lawful Basis |
|---|---|---|
| Processing ticket purchases | Identity, Contact, Transaction | Contract |
| Creating and managing your account | Identity, Contact, Profile | Contract |
| Contacting winners and arranging prize delivery | Identity, Contact | Contract |
| Responding to enquiries and complaints | Identity, Contact | Contract / Legitimate Interest |
| Age verification | Identity (date of birth) | Legal Obligation |
| Preventing fraud and unauthorised access | Identity, Technical | Legitimate Interest |
| Sending marketing emails (with consent) | Contact, Marketing | Consent |
| Improving our website and services | Technical | Legitimate Interest |
| Responsible play management | Responsible Play Data | Legal Obligation / Legitimate Interest |
| DCMS Voluntary Code compliance | Responsible Play Data | Legal Obligation / Legitimate Interest |
| Complying with legal obligations | All relevant data | Legal Obligation |
| Analytics and performance measurement | Technical | Legitimate Interest |
Marketing Communications
We will only send you marketing emails if you have explicitly consented to receive them on a per channel basis in line with the Data (Use and Access) Act 2025. You can withdraw your consent at any time by:
- Clicking the unsubscribe link in any marketing email
- Emailing us at info@kdcompetitions.co.uk
- Updating your preferences in your account settings
Withdrawing consent does not affect any processing carried out before your withdrawal. We will never sell your personal data to third parties for marketing purposes.
Cookies
We use cookies and similar tracking technologies on our website. Cookies are small text files stored on your device that help us provide and improve our services.
The types of cookies we use:
Essential Cookies Required for the website to function. These cannot be disabled. They include session cookies, security cookies and cart cookies.
Analytics Cookies Help us understand how visitors use our site so we can improve it. We use Google Analytics for this purpose. Data is anonymised where possible.
Marketing Cookies Used to show relevant advertisements and measure campaign effectiveness. Only set with your consent.
Functional Cookies Remember your preferences such as language settings and login status.
You can manage your cookie preferences at any time using our Cookie Preferences tool on our website. You can also manage cookies through your browser settings, however disabling certain cookies may affect website functionality.
For more information about cookies visit www.aboutcookies.org.
Sharing Your Personal Data
We do not sell your personal data. We may share your data with trusted third parties in the following circumstances:
Service Providers We work with carefully selected service providers who process data on our behalf including:
- Shopify Inc — our e-commerce platform and payment processing infrastructure
- Google Analytics — website analytics and performance measurement
- Email service providers — for transactional and marketing emails
- Royal Mail / postal services — for prize delivery
All service providers are contractually bound to process your data securely and only for the purposes we specify.
Legal Requirements We may disclose your personal data to law enforcement agencies, regulatory bodies or courts where we are legally required to do so, or where disclosure is necessary to protect the rights, property or safety of KD Competitions, our customers or others.
Business Transfer In the event that KD Competitions is sold or transferred, your personal data may be transferred to the new owner as part of that transaction. You will be notified of any such change.
International Data Transfers
Some of our service providers may process your data outside the United Kingdom. Where this occurs we ensure that appropriate safeguards are in place in accordance with UK GDPR, including:
- Transfers to countries with UK adequacy decisions
- Standard contractual clauses approved by the Information Commissioner's Office (ICO)
Data Retention
We retain your personal data only for as long as necessary for the purposes it was collected. Our retention periods are as follows:
| Data Type | Retention Period |
|---|---|
| Account and profile data | Duration of account plus 2 years after closure |
| Transaction and purchase records | 7 years (legal requirement) |
| Competition entry records | 2 years after competition close |
| Marketing consent records | Until consent withdrawn plus 1 year |
| Responsible play records | 7 years |
| Customer service communications | 3 years |
| Technical and analytics data | 26 months |
| Self-exclusion records | Duration of exclusion plus 2 years |
| DCMS Voluntary Code compliance records | 7 years |
When your data is no longer required we will securely delete or anonymise it.
Your Rights Under UK GDPR
You have the following rights regarding your personal data:
Right of Access You have the right to request a copy of the personal data we hold about you. This is known as a Subject Access Request (SAR). We will respond within one calendar month. Under the Data (Use and Access) Act 2025 you may submit access requests by email and we will acknowledge receipt promptly.
Right to Rectification You have the right to ask us to correct any inaccurate or incomplete personal data we hold about you.
Right to Erasure You have the right to ask us to delete your personal data in certain circumstances, for example where the data is no longer necessary for the purpose it was collected.
Right to Restrict Processing You have the right to ask us to restrict the processing of your personal data in certain circumstances, for example while we investigate a complaint.
Right to Data Portability Where we process your data by automated means based on your consent or a contract, you have the right to receive your data in a structured, commonly used and machine-readable format.
Right to Object You have the right to object to processing based on legitimate interests. You also have the absolute right to object to your data being used for direct marketing at any time.
Rights Relating to Automated Decision Making We do not currently use automated decision making or profiling that produces legal or similarly significant effects on individuals.
Right to Withdraw Consent Where we rely on consent as our lawful basis you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
How to Exercise Your Rights
To exercise any of your rights please contact us at:
Email: info@kdcompetitions.co.uk Subject line: Data Rights Request — [Type of Request]
Please include your full name and email address used on your account so we can identify you. We may need to verify your identity before processing your request.
We will respond within one calendar month. If your request is complex we may extend this by a further two months and will notify you accordingly.
There is no charge for exercising your rights unless requests are manifestly unfounded or excessive.
Data Security
We take the security of your personal data seriously and have implemented appropriate technical and organisational measures including:
- SSL encryption on all pages of our website
- Secure password hashing for account credentials
- Payment processing via PCI DSS compliant providers
- Access controls limiting staff access to personal data
- Regular security reviews and updates
Despite these measures no internet transmission is completely secure. We cannot guarantee the security of data transmitted to our site and any transmission is at your own risk. Once received we use strict procedures to protect your data.
In the event of a personal data breach we will notify the Information Commissioner's Office (ICO) within 72 hours where required and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
Children's Privacy
Our website and competitions are strictly for individuals aged 18 years and over. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that we have inadvertently collected data from someone under 18 we will delete it immediately.
If you believe a child has provided us with personal data please contact us at info@kdcompetitions.co.uk immediately.
Third Party Links
Our website may contain links to third party websites. This privacy policy applies only to our website. We are not responsible for the privacy practices of third party sites and encourage you to read their privacy policies before providing any personal data.
Changes to This Policy
We may update this privacy policy from time to time. When we make significant changes we will notify you by email or by displaying a prominent notice on our website. The date at the top of this policy indicates when it was last updated.
We encourage you to review this policy periodically to stay informed about how we protect your data.
Complaints
If you are unhappy with how we have handled your personal data you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Telephone: 0303 123 1113 Website: www.ico.org.uk
We would however appreciate the opportunity to address your concerns before you contact the ICO. Please contact us first at info@kdcompetitions.co.uk.
Contact Us
If you have any questions about this privacy policy or how we handle your personal data please contact us:
KD Competitions, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: info@kdcompetitions.co.uk Website: kdcompetitions.co.uk
This Privacy Policy was last reviewed in May 2026 and is compliant with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and the Data (Use and Access) Act 2025.
