How Prize Mart Ltd uses your personal data
Version 1.1 · Effective 17/10/2026 · Controller: Prize Mart Ltd
1.Who we are
1.1 Prize Mart Ltd (“Prize Mart”, “we”, “us”, “our”) is the controller of the personal data described in this Privacy Policy. We are a company registered in England and Wales with company number 17450740 and registered office at 15 Olympic Court, Boardmans Way, Whitehills Business Park, Blackpool, FY4 5GU. We are registered with the Information Commissioner’s Office (“ICO”) under number [Application Number - C2040389] TBC..
1.2 You can contact us about anything in this Policy, including to exercise your rights, at help@prizemart.co.uk or by post at the address above.
2.What this Policy covers
2.1 This Policy explains how we collect, use, share and keep personal data when you use the Prize Mart mobile app for iOS and Android (the “App”), our website at prizemart.co.uk, the free postal entry route, and when you contact us. It applies alongside our Terms of Use and our Competition Terms and Conditions; capitalised terms not defined here have the meaning given in those documents.
2.2 Our website and the App may link to third-party sites and services, including our payment provider, prize manufacturers, support organisations and the public drand randomness record. Those services have their own privacy notices and we are not responsible for them.
3.The personal data we collect
3.1 Account data. When you create an account we collect your email address, a password (stored only in hashed form), your first and last name, your date of birth, the date and time of sign-up, the IP address and device used, and your acceptance of our terms. If you enter a referral code we record it. We collect this directly from you. You must provide it to hold an account; without it we cannot offer you the App.
3.2 Entries, plays and results. We record every entry you obtain, its ticket number, how it was obtained, what it cost, and when; every play, the time it was made and its Instant Win result; your Site Credit and Cash balances and every change to them; Team-Up! group membership and referrals; the prizes you win; and the claims you submit. Draw records, including the locked entry pool, its fingerprint, the beacon round used and the result, are kept for every Raffle.
3.3 Payment data. Payments are taken by our payment provider, Cashflows, through the in-App payment sheet. Your card details are collected and stored by that provider under its own privacy notice at https://www.cashflows.com/legal/privacy-policy; we never see or store your full card number or security code. We receive and keep a payment token, the last four digits and card type, the amount, and a transaction reference, together with any refund or chargeback records.
3.4 Verification data. Before we pay out a Cash balance or an End Prize, or any prize we consider to be of significant value, we collect copies of documents proving your identity, age and address (for example a passport or driving licence and a recent bill), and your bank account name, sort code and account number for the payout. Where we reasonably consider it necessary we may also ask about the source of the funds you used to buy entries. You must provide this to receive such a prize.
3.5 Postal entry data. If you enter by post we collect what you write on the postcard or letter: your name, email address, date of birth, postal address, the Raffle you are entering and your confirmation of eligibility. We match this to your account and record whether the entry was accepted.
3.6 Support and complaints. If you contact us we keep your messages, our replies, and any documents you send, together with the account they relate to.
3.7 Device and usage data. When you use the App we automatically collect your device model and operating system, App version, a device or installation identifier, IP address, time zone and language, your push notification token, the screens you view and the actions you take in the App, and crash and error reports. Some of this is collected through the Google Firebase and Meta SDKs described in section 6.
3.8 Marketing preferences. We record whether you have consented to marketing emails and to advertising measurement, when, and any withdrawal.
3.9 We do not collect any special category data (such as data about health, race, religion or sexual orientation) or criminal offence data, and we ask you not to send us any. We do not collect precise location data and the App does not use your device’s location services.
4.How we use your personal data and our legal bases
4.1 UK data protection law requires us to have a legal basis for each use of your personal data. The uses and bases are:
(a) To create and run your account, record your entries, plays, results and balances, run the Raffles and award prizes — performance of our contract with you (the Terms of Use and Competition Terms and Conditions).
(b) To verify your age, identity and address, check the source of funds where necessary, and pay out Cash and prizes — performance of our contract, and our legal obligations not to allow entry by anyone under 18 and to prevent fraud and financial crime.
(c) To process payments, refunds and chargebacks — performance of our contract, and our legitimate interest in defending disputed payments.
(d) To send service communications: email verification, entry receipts, prize and claim notifications, and notices about changes to our terms — performance of our contract.
(e) To publish draw results and verification data, and winners’ first name and last initial — our legitimate interest in demonstrating that every Raffle is fair and that prizes are awarded, and our obligations under the CAP Code and the Voluntary Code of Good Practice for Prize Draw Operators (see section 5).
(f) To detect and prevent duplicate accounts, bots, abuse of the referral and Team-Up! features, fraud and other breaches of our terms — our legitimate interest in the integrity of the Raffles and in protecting other players, and our legal obligations.
(g) To keep the App secure, fix crashes and bugs, and understand how the App is used so we can improve it — our legitimate interest in running a reliable service.
(h) To measure the effectiveness of our advertising and to show our advertising to people likely to be interested — your consent, which you can withdraw at any time (section 6).
(i) To send you marketing emails and push notifications about new Raffles and offers — your consent, which you can withdraw at any time.
(j) To respond to your enquiries and complaints, and to exercise or defend our legal rights — performance of our contract and our legitimate interest in resolving disputes.
(k) To keep financial, tax and prize records — our legal obligations.
(l) To identify and respond to signs that a player’s participation may be harming them — our legitimate interest, and our obligations under the Voluntary Code of Good Practice, in operating responsibly.
4.2 Where we rely on a legitimate interest, we have considered the effect on you and concluded that it does not override your rights. You can ask us for details of that assessment, and you have the right to object (section 10).
5.What we publish
5.1 So that every draw can be independently verified, we publish for each Raffle: the complete list of ticket numbers in the locked entry pool, the pool fingerprint and its timestamps, the beacon round and random value, the Instant Win log and revealed secret, and the winning ticket number. Ticket numbers are not linked to names in anything we publish; only you can see which ticket numbers are yours.
5.2 We publish the End Prize winner’s first name and last initial with the result, in the App and on our website and social channels. You may object to that publication by writing to us; if you do, we will still provide your name and winning entry to the Advertising Standards Authority or another regulator on request, as the CAP Code requires.
5.3 We use your full name, photograph, video or other likeness in publicity only with your separate, freely given consent, which you may decline or withdraw without affecting any prize.
5.4 Members of your Team-Up! group can see your first name and that you are a member. Your referral code is visible to anyone you give it to.
6.Analytics, advertising and push notifications
6.1 Google Firebase. The App uses Google Analytics for Firebase to record screen views and in-App events, Firebase Crashlytics to collect crash reports, and Firebase Cloud Messaging to deliver push notifications. These services process a Firebase installation identifier, your device and App details, and event data on Google’s servers. We use them for the purposes in clause 4.1(d), (g) and (i). Google’s privacy notice is at policies.google.com/privacy.
6.2 Meta. The App includes the Meta (Facebook) SDK, which reports app events such as installs, sign-ups and purchases to Meta Platforms so that we can measure whether our advertising on Meta’s platforms is working and show our advertising to people likely to be interested. Meta receives your device’s advertising identifier where your device settings allow it, and the event data, and processes it under its own privacy notice at facebook.com/privacy/policy and as our processor under its data processing terms. The Meta SDK does not send us any information about you from Meta.
6.3 Advertising measurement runs only with your consent. On iOS, we ask through Apple’s App Tracking Transparency prompt; on Android, and where you have not been asked in the App, we ask when you first use the App. You can withdraw consent at any time in the App’s privacy settings or through your device’s advertising settings, after which the Meta SDK stops sending events from your device. Withdrawing consent does not affect your account or your entries.
6.4 Push notifications are delivered through your device’s notification service using a token issued for your device. Service notifications (verification, prizes, claims) are sent on the basis of our contract with you; marketing notifications only with your consent. You can turn off all push notifications in your device settings and marketing notifications in the App.
6.5 Our website uses only cookies that are strictly necessary for it to work, unless we tell you otherwise on the website and ask for your consent.
7.Who we share your personal data with
7.1 We share personal data only where necessary, with the following categories of recipient, each of which may only use it for the purpose we share it for:
(a) Hosting and infrastructure — Amazon Web Services (hosting, databases, storage and backups, sending verification, receipt and notification emails).
(b) Analytics, crash reporting and push notifications — Google (Firebase), as described in section 6.
(c) Advertising measurement — Meta Platforms, only with your consent, as described in section 6.
(d) Payments — Cashflows, which processes your card payments and any refunds, and our bank, which receives your account name and number when we pay out Cash or a cash prize.
(e) Prize fulfilment — the suppliers and delivery companies who dispatch physical prizes, who receive your name, delivery address and, where needed for delivery, your phone number or email address.
(g) Professional advisers — our accountants, auditors, lawyers and insurers, where they need it to advise us.
(h) Regulators and authorities — the Advertising Standards Authority, the Department for Culture, Media and Sport, the ICO, the police, HMRC, banks and payment schemes, where the law requires it, to demonstrate that a prize was awarded, or to prevent or investigate fraud or other crime.
(i) A buyer or successor — if we sell or transfer our business, the buyer, who will be bound by this Policy in relation to your data.
7.2 We do not sell your personal data and do not share it with third parties for their own marketing.
8.International transfers
8.1 Our servers are located in [the United Kingdom / the EU (AWS region)]. Google, Meta and some of our other providers process data in the United States and other countries outside the UK. Where they do, we rely on the UK Extension to the EU-US Data Privacy Framework (the “UK-US Data Bridge”) for providers certified under it, and otherwise on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses approved by the ICO. You can ask us for a copy of the safeguard that applies to a particular transfer.
9.How long we keep your personal data
9.1 We keep personal data only as long as we need it for the purposes above or as the law requires. In particular:
(a) Account data — while your account is open and for [12] months after it is closed, so that we can deal with complaints, chargebacks and fraud; then deleted or anonymised. If you ask us to delete your account (section 10.5), the personal data in it is deleted within 30 days of your request; only the records in (b) and (c), which no longer identify you on their own, are kept.
(b) Entry, play, balance, prize and payment records — for six years after the end of the financial year they relate to, as required for tax and accounting purposes and to defend claims.
(c) Published draw records (ticket numbers, entry lists, fingerprints, beacon data and results) — indefinitely, as a permanent public record of each Raffle. They do not contain names or contact details.
(d) Verification documents — deleted within [30] days after verification is complete; a record that verification was carried out, and of its outcome, is kept with the prize record under (b).
(e) Postal entries — the postcard or letter is securely destroyed [90] days after the Raffle closes; the record of the entry is kept under (b).
(f) Support and complaint records — for [two] years after the matter is closed.
(g) Firebase analytics data — for [14] months, Google’s default retention for this service; crash reports for [90] days.
(h) Marketing consent and withdrawal records — for as long as we send you marketing and for [two] years after you withdraw consent, so that we can show what you agreed to.
9.2 Where we are unable to delete data from backups immediately, we isolate it from further use until the backup is overwritten in the ordinary course.
10.Your rights
10.1 You have the right to: ask for a copy of the personal data we hold about you; have inaccurate data corrected; have your data deleted where we no longer need it or where you withdraw consent; restrict how we use it in some circumstances; receive the data you gave us in a portable form; object to processing based on our legitimate interests, and to any direct marketing; and withdraw consent at any time without affecting what was done before.
10.2 To exercise any of these rights, contact us at help@prizemart.co.uk or use the tools in the App’s Account section. We may need to confirm your identity first. We will respond within one month, or tell you if we need longer and why. Exercising your rights is free unless a request is clearly unfounded or excessive.
10.3 Some data cannot be deleted on request: draw records are a permanent public record and do not identify you; entry, payment and prize records must be kept for the periods in section 9; and we may keep records needed to prevent fraud or defend claims. Where we refuse a request we will tell you why.
10.4 You have the right to complain to the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113. We would welcome the chance to address your concern first.
10.5 Deleting your account. You can ask us to delete your account at any time from the Manage my account page in the App (Account > Manage my account > Request account deletion) or by emailing help@prizemart.co.uk from the email address on your account. You only need to ask once. We delete your account and the personal data in it within 30 days of your request, and deletion cannot be undone. Before you submit a request the App warns you that any prizes you have not claimed, your Cash balance and your Site Credit are given up when the account is deleted, and that your entries in draws still to be held are withdrawn (Competition Terms, clause 4.4). The records we must keep under section 9(b) and (c) are kept without your name or contact details, so that they no longer identify you on their own, together with a record of the deletion itself (which account was deleted, when, and what was given up) that contains no personal data.
11.Automated checks
11.1 When you sign up, automated checks verify that your date of birth shows you are 18 or over, that your email address is genuine, and that your details do not match an existing account. A sign-up that fails these checks is refused automatically. Any decision to close an account, void entries or withhold a prize is made by a member of our team, and you can ask us to review it under our complaints process.
11.2 Instant Win and End-Prize draw results are decided automatically by chance. They are not decisions about you and do not use your personal data beyond your ticket numbers.
12.Security
12.1 We protect your personal data with technical and organisational measures appropriate to its sensitivity, including encryption in transit and at rest, hashed passwords, access controls, logging, and separate handling for verification documents and bank details. No system is completely secure; if a breach affecting your data is likely to result in a high risk to you, we will tell you and the ICO as the law requires.
13.Children
13.1 The App and the Raffles are for adults only. We do not knowingly collect personal data from anyone under 18. If we learn that we hold data about someone under 18 we will close the account and delete the data, and the consequences for any entries or prizes are as set out in the Competition Terms and Conditions. If you believe a person under 18 has an account, contact us at help@prizemart.co.uk.
14.Changes to this Policy
14.1 We may update this Policy from time to time. The current version, with its date, is always available in the App and at https://www.prizemart.co.uk/legal/privacy-policy. If a change materially affects how we use your data we will tell you in the App or by email before it takes effect.
14.2 This Policy was last updated on 17/10/2026.