Privacy Policy

This policy explains what personal data we collect, why, how we look after it, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018). Please read it alongside our Terms & Conditions and our Cookie section below.

1. Who we are

PixelComps (pixelcomps.co.uk) is operated by Pixel Competitions Ltd (company number 17179948), registered in England and Wales, registered office The Pump House Office 4, Coton Hill, Shrewsbury, SY1 2DP. We are the data controller for your personal data. For anything privacy-related, email [email protected].

2. The information we collect

• Account details: your name, email address, and a securely hashed version of your password.
• Contact and delivery details: phone number and postal address, mainly so we can reach winners and deliver prizes.
• Payment details: payments are handled by Cashflows. We don't store your full card number; we keep a payment reference, the amount, and whether it succeeded.
• Entry and account activity: tickets bought, competitions entered, loyalty points (where that feature is on), and login history.
• Technical data: IP address, approximate location (country, from your IP), browser type, and access timestamps, used for security and fraud prevention.
• Two-factor authentication: if you turn on 2FA, we securely store the secret used to check your authenticator codes.
• Winner verification: if you win, we may collect proof of identity and, for cash prizes, bank account confirmation.
• Communication preferences: whether you've opted in to marketing.

We don't collect special-category data (such as health, ethnicity, or religion) and we don't knowingly collect data from anyone under 18.

3. How and why we use your data

What we do	Why (legal basis)
Run your account, process entries and payments, deliver prizes	Performance of our contract with you
Email you about your account, purchases, and competition results	Performance of our contract with you
Prevent fraud and abuse, keep the site secure, verify winners	Our legitimate interests (and legal obligation where it applies)
Meet accounting, tax, anti-money-laundering, and ASA obligations	Legal obligation
Send marketing (where you've opted in)	Your consent
Improve the site and understand how it's used	Our legitimate interests

Where we rely on legitimate interests, we balance them against your rights and only proceed where yours don't override ours.

4. Marketing and your choices

We'll only send marketing emails if you've opted in or you're an existing customer who hasn't opted out. You can unsubscribe at any time using the link in any marketing email, or by emailing us. Opting out of marketing doesn't stop essential service messages (entry confirmations, winner notifications, security alerts). We won't share your data with third parties for their own marketing without your explicit consent.

5. Who we share it with

We don't sell your personal data. We share it only where needed, with:

• Cashflows: to process payments.
• Our email and hosting providers: to send service emails and run the site.
• Couriers and prize suppliers: to deliver prizes you've won.
• Regulators and authorities: including HMRC and the Advertising Standards Authority, and law enforcement where the law requires it.
• A buyer: if we ever sell or restructure the business, under the same protections set out here.

All providers acting on our behalf are bound to keep your data secure and use it only on our instructions.

6. Sending data outside the UK

Most of our providers process data in the UK or EEA. If any data is transferred elsewhere, we make sure it's protected by an approved safeguard: a UK "adequacy" decision, or standard contractual clauses / the UK International Data Transfer Agreement. Ask us if you'd like detail on a specific provider.

7. How long we keep it

• Account data: while your account is active, then deleted or anonymised on request.
• Transaction and AML records: at least 6 years, to meet accounting, tax, and anti-money-laundering rules.
• Login logs: automatically purged after 24 hours.

We may keep data longer where there's a complaint or a realistic prospect of legal action.

8. How we protect it

• Passwords hashed with bcrypt; optional two-factor authentication (TOTP).
• HTTPS with strict transport security for all traffic.
• CSRF protection with token rotation, and rate limiting on login and 2FA.
• Secure sessions using HttpOnly, SameSite, and Secure cookie flags.
• Content Security Policy and other security headers.

We have procedures to handle any suspected data breach and will notify you and the regulator where the law requires.

9. Cookies

Cookies are small files stored on your device. We use strictly necessary cookies only. We don't currently use analytics, advertising, or third-party tracking cookies.

Cookie type	Purpose
Session	Keeps you logged in and remembers your basket as you move around the site
Authentication	Confirms it's really you and protects your account
Security (CSRF)	Protects forms and actions from cross-site attacks

These cookies are essential for the site to work, so they don't require consent and can't be switched off through a banner. You can block or delete cookies in your browser settings, but parts of the site may then stop working (for example, you may not be able to log in). If we ever introduce analytics or marketing cookies, we'll ask for your consent first through a cookie banner and update this section.

10. Your rights

Under UK data protection law you can:

• Access a copy of the data we hold about you.
• Correct data that's wrong or incomplete.
• Erase your data where there's no good reason for us to keep it.
• Port your data to another provider in a common format.
• Object to processing based on our legitimate interests, and to direct marketing at any time.
• Restrict how we use your data in certain situations.
• Withdraw consent at any time, where we rely on it.

To exercise any of these, email [email protected]. It's normally free, and we'll respond within one month. We may ask you to confirm your identity first. Note that some requests (such as erasure) may mean we can no longer enter you into competitions or contact you if you win, and we may need to keep certain records to meet legal obligations.

If you're unhappy with how we've handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.

11. Winners and publicity

If you win, we publish a winners list and entry list on the site, ordinarily showing the surname and county of major winners, to meet the CAP Code (enforced by the ASA). You can object before the closing date, but even then we may have to provide your details and winning entry to the ASA on request, to prove the competition was run fairly. See our Terms & Conditions for more.

12. Other websites

Our site may link to other websites. We're not responsible for their privacy practices, so please read their policies when you visit them.

13. Children

The site is for adults aged 18 and over. We don't knowingly collect data from anyone under 18, and we'll delete it if we discover we have.

14. Changes to this policy

We may update this policy from time to time. The latest version is always on this page with a revised "last updated" date, and we'll flag material changes by email or site notice.

15. Contact us

Pixel Competitions Ltd, company number 17179948 (England and Wales)
Registered office: The Pump House Office 4, Coton Hill, Shrewsbury, SY1 2DP
Email: [email protected]