Version number: Version 1.0

Effective date: 18/11/2025

​​

​

1. Introduction

​KW Promotions Ltd, trading as "The Big Prize Company" ("we," "us," or "our"), is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, and protect your Personal Data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

​2. Our Details and Contact Information

• ​Data Controller: KW Promotions Ltd, trading as The Big Prize Company

• ​Registered Address: Clyde Offices, 2nd Floor, 48 West George Street, Glasgow, G2 1BP

• ​Company Contact Email: admin@bigprizecompany.com

• ​Data Protection Contact: The Directors of KW Promotions Ltd.

​3. The Personal Data We Collect

• ​Identity Data:

  • ​Details: Full Name, Date of Birth.

  • ​Purpose: Account Registration, Free Entry Postcard, Winner Verification.

• ​Contact Data:

  • ​Details: Residential Address, Email Address, Telephone Number.

  • ​Purpose: Account Registration, Free Entry Postcard, Prize Delivery.

• ​Financial Data:

  • ​Details: Payment card details (processed securely by a third-party payment provider, not stored by us).

  • ​Purpose: Purchase of Entry Tickets, Subscription Payments.

• ​Transaction Data:

  • ​Details: Records of products/services purchased, prize draws entered, subscription history.

  • ​Purpose: Website Activity, Internal Records.

• ​Technical Data:

  • ​Details: IP Address, login data, browser type and version, time zone setting and location, operating system.

  • ​Purpose: Website Logs, Analytics (e.g., Google Analytics).

• ​Marketing Data:

  • ​Details: Your preferences in receiving marketing from us and your communication preferences.

  • ​Purpose: Opt-in Forms, Account Settings.

• ​Special Categories:

  • ​Details: Information related to problem gambling (if volunteered by you in Section 7 of the T&Cs).

  • ​Purpose: Direct communication via email/phone.

4. How We Collect Your Data

​We collect data via:

• ​Direct Interactions: When you register an account, purchase tickets, subscribe, enter a prize draw by post, or contact us directly.

• ​Automated Technologies: As you interact with our website, we automatically collect Technical Data via cookies and server logs.

• ​Third Parties: We receive Financial Data from payment providers (e.g., Stripe) regarding successful or failed transactions, but we do not store your full card details.

5. The Legal Basis for Processing Your Data

​(This section also had a table in the original policy)

• ​Processing Activity: Prize Draw Entry & Administration

  • ​Legal Basis: Contract

  • ​Details: Processing your Identity, Contact, and Transaction Data to fulfil our contractual obligation to enter you into the draw, conduct the draw, and notify winners, as set out in our Terms & Conditions.

• ​Processing Activity: Prize Delivery

  • ​Legal Basis: Contract

  • ​Details: Using your Contact Data to arrange delivery of physical prizes.

• ​Processing Activity: Anti-Fraud & Age Checks

  • ​Legal Basis: Legal Obligation / Legitimate Interests

  • ​Details: Verifying age (18+) and UK residency as required by law and our T&Cs, and detecting fraudulent activity.

• ​Processing Activity: Publication of Winners

  • ​Legal Basis: Legitimate Interests

  • ​Details: Publishing the winner's surname and county (as per CAP Code) to prove the prize was awarded. Winners have the right to object (see Section 9).

• ​Processing Activity: Marketing Communications

  • ​Legal Basis: Consent

  • ​Details: Sending you emails about future draws or promotions. This is entirely optional and requires explicit, separate opt-in consent from you.

• ​Processing Activity: Responsible Play Support

  • ​Legal Basis: Legitimate Interests / Vital Interests

  • ​Details: Using any Special Category Data you volunteer (e.g., self-exclusion requests) to uphold our commitment to player welfare (Section 7 T&Cs).

6. How We Use Your Data

​We use your personal data for the following purposes:

1. ​To manage your account and process transactions (Contract).

2. ​To administer and run the prize draws, including entering your data into the random draw selection system (Contract).

3. ​To contact you if you are a winner and arrange prize delivery (Contract).

4. ​To verify your identity, age, and UK residency to ensure eligibility (Legal Obligation/Legitimate Interests).

5. ​To publish winner details (surname and county) on our website and social media (Legitimate Interests/Contract).

6. ​To manage any subscription services you sign up for (Contract).

7. ​To send you marketing material about new draws, only where you have given explicit consent (Consent).

8. ​To prevent fraudulent or illegal activity and protect the integrity of our draws (Legitimate Interests).

9. ​To fulfil legal obligations and cooperate with regulatory bodies (Legal Obligation).

​7. Who We Share Your Data With

​We may share your personal data with the following third parties:

• ​Payment Processors: Companies like Stripe or PayPal to securely handle ticket payments. We do not store your full payment card details.

• ​Delivery and Fulfilment Providers: Couriers (e.g., Royal Mail, DPD) or fulfilment agents to deliver your prize.

• ​Fraud Prevention Agencies: To verify identity and prevent illegal activity.

• ​Legal/Regulatory Authorities: If legally required to do so, such as the Advertising Standards Authority (ASA) or law enforcement.

• ​Google/Facebook/YouTube: To livestream draws and potentially verify winners (if you entered via those platforms).

• ​Marketing Providers: Email software (e.g., Mailchimp) for sending marketing communications, only if you have opted in.

​8. Data Retention

​We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

• ​Draw Entry Data (Non-Winners): Retained for a maximum of 12 months after the draw closes to handle any post-draw queries or legal challenges.

• ​Winner Data: Retained for 7 years to satisfy legal accounting and regulatory audit requirements.

• ​Marketing Consent Data: Retained until you withdraw your consent or after a period of prolonged inactivity (e.g., 2 years).

• ​Account Data: Retained until you close your account or if your account is deleted after 12 months of inactivity (as per our T&Cs).

​9. Your Rights Under UK GDPR

​Under data protection law, you have rights, including:

• ​The right to be informed. (This Policy aims to do this).

• ​The right of access. You can request a copy of the personal data we hold about you.

• ​The right to rectification. You can ask us to correct incomplete or inaccurate data we hold about you.

• ​The right to erasure (The 'right to be forgotten'). You can ask us to delete your personal data. This may be limited if we need to keep your data for legal or contractual purposes (e.g., for accounting records or if you are a recent winner).

• ​The right to restrict processing. You can ask us to suspend the processing of your personal data.

• ​The right to data portability. You can ask us to transfer your data to another party.

• ​The right to object to processing. You can object to us processing your data where we rely on a Legitimate Interest basis.

​Specific to Winners (Right to Object):

As a winner, we need to publish your surname and county for transparency (Legitimate Interest, as required by the ASA/CAP Code). You have the right to object to this publication or request that only limited information is published. If you object, we will notify the ASA of your objection and may withhold the prize if we cannot meet our transparency obligations.

​10. Withdrawing Consent

​Where we are relying on consent (i.e., for marketing communications), you have the right to withdraw that consent at any time. You can do this by using the 'unsubscribe' link in any marketing email or by emailing us at admin@bigprizecompany.com.

​11. How to Complain

​If you have any concerns about our use of your personal data, you can contact us directly using the details in Section 2. You also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.

• ​ICO Contact Details: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

• ​ICO Website: www.ico.org.uk