Privacy Policy

This policy explains what personal data we collect, why, how we look after it, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018). Please read it alongside our Terms & Conditions and our Cookie section below.

1. Who we are

PixelComps (pixelcomps.co.uk) is operated by Pixel Competitions Ltd (company number 17179948), registered in England and Wales, registered office The Pump House Office 4, Coton Hill, Shrewsbury, SY1 2DP. We are the data controller for your personal data. For anything privacy-related, email [email protected].

2. The information we collect

• Account details: your name, email address, and a securely hashed version of your password.
• Contact and delivery details: phone number and postal address, mainly so we can reach winners and deliver prizes.
• Payment details: payments are handled by Cashflows. We don't store your full card number; we keep a payment reference, the amount, and whether it succeeded.
• Entry and account activity: tickets bought, competitions entered, loyalty points (where that feature is on), and login history.
• Technical data: IP address, approximate location (country, from your IP), browser type, and access timestamps, used for security and fraud prevention.
• Two-factor authentication: if you turn on 2FA, we securely store the secret used to check your authenticator codes.
• Winner verification: if you win, we may collect proof of identity and, for cash prizes, bank account confirmation.
• Communication preferences: whether you've opted in to marketing.
• Newsletter sign-ups: if you sign up to our newsletter, your email address, when you signed up and confirmed, and the IP address you signed up from, as a record of your consent. You don't need an account to sign up.

We don't collect special-category data (such as health, ethnicity, or religion) and we don't knowingly collect data from anyone under 18.

3. How and why we use your data

What we do	Why (legal basis)
Run your account, process entries and payments, deliver prizes	Performance of our contract with you
Email you about your account, purchases, and competition results	Performance of our contract with you
Prevent fraud and abuse, keep the site secure, verify winners	Our legitimate interests (and legal obligation where it applies)
Meet accounting, tax, anti-money-laundering, and ASA obligations	Legal obligation
Send marketing and our newsletter (where you've opted in)	Your consent
Improve the site and understand how it's used	Our legitimate interests

Where we rely on legitimate interests, we balance them against your rights and only proceed where yours don't override ours.

4. Marketing and your choices

We'll only send marketing emails if you've opted in or you're an existing customer who hasn't opted out. You can unsubscribe at any time using the link in any marketing email, or by emailing us. Opting out of marketing doesn't stop essential service messages (entry confirmations, winner notifications, security alerts). We won't share your data with third parties for their own marketing without your explicit consent.

You can sign up to our newsletter at the bottom of any page. If you aren't signed in, we'll email you a link to confirm before we add you. If your address has an account, that account's marketing choice applies to it, and we never send marketing while you're on a break or self-excluded.

5. Who we share it with

We don't sell your personal data. We share it only where needed, with:

• Cashflows: to process payments.
• Our email and hosting providers: to send service emails and run the site.
• Couriers and prize suppliers: to deliver prizes you've won.
• Meta Platforms (Facebook and Instagram): only if you accept marketing cookies, so we can measure our advertising. See section 9.
• Regulators and authorities: including HMRC and the Advertising Standards Authority, and law enforcement where the law requires it.
• A buyer: if we ever sell or restructure the business, under the same protections set out here.

All providers acting on our behalf are bound to keep your data secure and use it only on our instructions.

6. Sending data outside the UK

Most of our providers process data in the UK or EEA. If any data is transferred elsewhere, we make sure it's protected by an approved safeguard: a UK "adequacy" decision, or standard contractual clauses / the UK International Data Transfer Agreement. Ask us if you'd like detail on a specific provider. Meta Platforms, Inc. processes Meta Pixel data in the United States under the UK Extension to the EU-US Data Privacy Framework.

7. How long we keep it

• Account data: while your account is active, then deleted or anonymised on request.
• Transaction and AML records: at least 6 years, to meet accounting, tax, and anti-money-laundering rules.
• Login logs: automatically purged after 24 hours.
• Newsletter sign-ups: until you unsubscribe. After that we keep your email address and when you left, so we don't email you again by mistake. Sign-ups that are never confirmed are deleted after 30 days.

We may keep data longer where there's a complaint or a realistic prospect of legal action.

8. How we protect it

• Passwords hashed with bcrypt; optional two-factor authentication (TOTP).
• HTTPS with strict transport security for all traffic.
• CSRF protection with token rotation, and rate limiting on login and 2FA.
• Secure sessions using HttpOnly, SameSite, and Secure cookie flags.
• Content Security Policy and other security headers.

We have procedures to handle any suspected data breach and will notify you and the regulator where the law requires.

9. Cookies

Cookies are small files stored on your device. We use strictly necessary cookies to run the site, and one marketing cookie (the Meta Pixel) which is only set if you accept it in our cookie banner. We don't use analytics cookies.

Cookie	Type	Purpose	Lasts
Session	Strictly necessary	Keeps you logged in and remembers your basket as you move around the site	Until you close your browser
Authentication	Strictly necessary	Confirms it's really you and protects your account (held in the session cookie)	Until you close your browser
Security (CSRF)	Strictly necessary	Protects forms and actions from cross-site attacks (held in the session cookie)	Until you close your browser
cc_cookie	Strictly necessary	Remembers the choice you made in the cookie banner so we don't ask again	12 months
_fbp (Meta Pixel)	Marketing	Set by Meta Platforms, Inc. Tells Meta which pages you visit here, and when you verify a new account, add tickets to your basket, start checkout or complete a purchase (which competitions and the amount), so we can measure our Facebook and Instagram adverts and show you more relevant ones. Your name, email address and card details are not sent.	90 days

Strictly necessary cookies don't require consent and can't be switched off through the banner. The Meta Pixel is off by default: no script loads and nothing is sent to Meta unless you choose "Accept all" or turn on Marketing in the preferences panel. You can change or withdraw your choice at any time using the "Cookie settings" link in the footer of every page; withdrawing removes the Meta cookie from this site. You can also block or delete cookies in your browser settings, but parts of the site may then stop working (for example, you may not be able to log in). Meta's own use of this data is described in the Meta Privacy Policy.

10. Your rights

Under UK data protection law you can:

• Access a copy of the data we hold about you.
• Correct data that's wrong or incomplete.
• Erase your data where there's no good reason for us to keep it.
• Port your data to another provider in a common format.
• Object to processing based on our legitimate interests, and to direct marketing at any time.
• Restrict how we use your data in certain situations.
• Withdraw consent at any time, where we rely on it.

To exercise any of these, email [email protected]. It's normally free, and we'll respond within one month. We may ask you to confirm your identity first. Note that some requests (such as erasure) may mean we can no longer enter you into competitions or contact you if you win, and we may need to keep certain records to meet legal obligations.

If you're unhappy with how we've handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.

11. Winners and publicity

If you win, we publish a winners list and entry list on the site, ordinarily showing the surname and county of major winners, to meet the CAP Code (enforced by the ASA). You can object before the closing date, but even then we may have to provide your details and winning entry to the ASA on request, to prove the competition was run fairly. See our Terms & Conditions for more.

12. Other websites

Our site may link to other websites. We're not responsible for their privacy practices, so please read their policies when you visit them.

13. Children

The site is for adults aged 18 and over. We don't knowingly collect data from anyone under 18, and we'll delete it if we discover we have.

14. Changes to this policy

We may update this policy from time to time. The latest version is always on this page with a revised "last updated" date, and we'll flag material changes by email or site notice.

15. Contact us

Pixel Competitions Ltd, company number 17179948 (England and Wales)
Registered office: The Pump House Office 4, Coton Hill, Shrewsbury, SY1 2DP
Email: [email protected]