PRIVACY POLICY

Kiwi Competitions is a UK-based prize competition platform. We are the data controller responsible for your personal data. This Privacy Policy explains how we collect, use, store, and protect your information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We may collect the following personal data when you use our website or enter competitions:

• Identity data: Full name, date of birth
• Contact data: Email address, phone number, postal address
• Account data: Username, password (encrypted), account preferences
• Transaction data: Payment details (processed securely by Stripe — we never see or store your card number), purchase history, ticket numbers
• Technical data: IP address, browser type, device information, cookies
• Usage data: Pages visited, time on site, referral source

We use your personal data for the following purposes:

• To operate competitions: Processing entries, selecting winners, delivering prizes
• To manage your account: Registration, login, order history
• To process payments: Completing transactions securely via Stripe
• To communicate with you: Order confirmations, winner notifications, customer support
• To send marketing: Promotional emails about new competitions (only with your consent — you can unsubscribe at any time)
• To improve our service: Analysing usage patterns to enhance website performance
• To comply with legal obligations: Age verification, fraud prevention, regulatory requirements

We process your data under the following legal bases:

• Contract: To fulfil our obligations when you enter a competition
• Consent: For marketing communications (withdrawable at any time)
• Legitimate interest: To improve our services, prevent fraud, and ensure site security
• Legal obligation: To comply with applicable laws and regulations

We do not sell your personal data to third parties. We may share data with:

• Stripe: To process payments securely
• Courier services: To deliver physical prizes (name and address only)
• Email service providers: To send transactional and marketing emails
• Legal authorities: If required by law, regulation, or legal process

All third-party processors are required to handle your data securely and in accordance with UK GDPR.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Account data: Retained while your account is active, deleted upon request
• Transaction data: Retained for 6 years for tax and accounting purposes
• Marketing data: Retained until you unsubscribe or request deletion

Under UK GDPR, you have the following rights:

• Right of access: Request a copy of the data we hold about you
• Right to rectification: Request correction of inaccurate data
• Right to erasure: Request deletion of your data (“right to be forgotten”)
• Right to restrict processing: Request we limit how we use your data
• Right to data portability: Request your data in a machine-readable format
• Right to object: Object to processing based on legitimate interests or marketing
• Right to withdraw consent: Withdraw marketing consent at any time

We implement appropriate technical and organisational measures to protect your personal data, including SSL encryption, secure hosting, and access controls. Payment data is handled entirely by Stripe and never touches our servers.

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. We encourage you to review this page periodically.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.