Privacy Policy

CROWN AND EAGLE COMPETITIONS LTD, trading as Crown & Eagle Competitions, is responsible for the personal data processed through the Crown & Eagle Competitions website (the “controller” under data protection law). The registered address is 6 East Grove Road, Newport, NP19 9QG. Company number: 17307252. ICO registration number: ZC195820.

Privacy contact: [email protected].
Telephone: 07550 015021.

We may collect:

• Your account: your name, contact details, date of birth, address, age and identity checks, and login and security records.
• Entries and payments: your competition entries, payment and refund records, Sovereigns activity, and older records of past quiz attempts and of Account Credit held before October 2026.
• Free postal entries: the details listed below, and any accessibility adjustment linked to your email address.
• Winners: claim details, delivery address, bank details for cash prizes, the town or city nearest to you, and your message if you choose to send one.
• Support: complaints and support messages.
• Technical: device information and website usage data.

We do not require a diagnosis or medical details to record a postal-entry accessibility adjustment.

For a free postal entry, we record your name, email address, date of birth, postcode and the competition code. We do not record a phone number or your full home address from a postal entry.

• Contract: creating and managing an account; checking eligibility; operating competitions; processing entries, payments, refunds and Sovereigns; contacting entrants about their entries; verifying winners; and delivering prizes.
• Legal obligation: tax and accounting records; responding to regulators and lawful requests; handling data-rights requests; and meeting duties relating to fraud, financial records and personal-data breaches.
• Legitimate interests: securing the website and accounts; preventing and investigating fraud, duplicate accounts, payment abuse and rule breaches; enforcing Player Protection controls; resolving complaints and legal claims; maintaining draw and operational audit records; publishing winners’ initials, nearest town or city and prize, to show that prizes are awarded fairly; telling postal entrants which of their entries were not entered; and improving service reliability. Our interests are safe, fair and accountable operation. We balance these interests against the effect on customers and provide a right to object.
• Consent: each optional category of marketing email, each non-essential cookie category, and publishing a winner’s message. Consent can be withdrawn at any time without affecting earlier lawful processing.

We do not rely on consent for processing that is necessary to provide an account or competition entry. If we need to use personal data for a materially different purpose, we will explain that purpose and the applicable lawful basis before doing so.

Most personal data comes directly from you. We may also receive payment, authorisation status and fraud signals from our payment processor, your bank or another payment provider displayed at checkout, delivery information from postal or prize providers, referral information from another customer, security or verification results from providers used for those purposes, and results of checks on bank details given for cash prizes.

Name, email address, date of birth and a password are contractually required to create an account. Entry, payment and eligibility information is required when you enter a competition; delivery or bank information is required only where needed to provide a prize. If required information is not provided, we may be unable to create the account, accept an entry, process a payment, verify eligibility, or deliver or pay a prize. Marketing choices and non-essential cookies are optional and do not affect access to the core service.

Card payments are handled by a third-party, PCI-DSS compliant payment processor, whether by redirecting you to its own secure payment page or via payment fields it hosts directly within our checkout. Our payment processor is currently Nochex Limited. Nochex receives the payment details you enter, together with your email address, the amount and an order reference from us, and uses them to process the payment and to prevent fraud. It may share payment information with card issuers, card schemes such as Visa and Mastercard, and fraud prevention agencies where needed for those purposes or where the law requires it.

We receive and retain payment identifiers, amounts, currency, status changes, failure, refund and chargeback information needed to confirm or withdraw entries and reconcile payments. If a card or another payment option is displayed, its named provider may process equivalent payment and security information; we do not store full payment card numbers.

Our payment processor may ask for your billing address to verify your card. The processor collects it directly; we do not receive or store it. Your card issuer may also ask you to confirm the payment on its own page (3D Secure). That check is between you and your card issuer; we only receive the result.

Where a cash prize is paid to a winner, the winner's bank details are used only for that payment and for verification, fraud prevention, accounting and compliance purposes. We do not collect bank details for refunds: card payments are refunded to the card.

Only authorised staff can see bank details. We permanently mask them 90 days after the prize is paid, unless we need to keep them for an active dispute, fraud review, tax check or legal reason. In that case, we mask them as soon as that need ends.

We keep draw records (including eligible entry hashes, and any redraws with their reasons), payment and refund records, postal entry and reserve records, historical quiz statistics, records of blocked Player Protection limit attempts and suspended account access attempts, and operational audit logs.

These records help us show that competitions are fair and secure, handle disputes and meet our legal duties. We keep them for the periods set out in the Retention section.

We publish limited winner information to show that each prize was won fairly. For each winner, we publish their initials, the town or city nearest to them, the prize, and the draw details, including the winning ticket number. We only publish a message from the winner if they agree to it on the claim form, and they can choose to show it anonymously. We never publish a winner's full name, address or contact details.

You can hide your wins from public winner lists in your profile settings, or by emailing [email protected]. Even if you do, we may still need to give winner information to the Advertising Standards Authority, a regulator, court, law enforcement body or other competent authority.

Service messages about your account, entries, payments, complaints, Player Protection settings or competition administration are not marketing.

Optional marketing emails are sent only for the categories you actively select: general competition alerts, the Friday closing-soon email, the fortnightly competition digest, and general Crown & Eagle updates. Registration is not automatic marketing consent.

You can unsubscribe using the link in an email or change individual choices in your profile. We keep consent and unsubscribe records so we can demonstrate and respect your choices.

If you watch a competition, we send you reminders about it. These aren't marketing, because you asked for them. To stop them, remove the competition from your watchlist.

Service providers may include our payment processor (currently Nochex Limited) and any other payment provider displayed at checkout for payment processing, reconciliation and fraud prevention, Postmark for automated or transactional email delivery and any marketing emails where enabled, DigitalOcean for website or server hosting, database hosting providers, domain/DNS/security providers, Cloudflare for bot protection on our forms, Bunny Fonts, which serves the website’s fonts, postal services, prize delivery providers, fraud/age-verification providers where used, a bank account checking provider (which receives the sort code and account number you enter for a cash prize, to confirm they match a UK bank account), and professional advisers such as accountants, solicitors and insurers.

We don't use any analytics, advertising pixels, heatmap tools or affiliate trackers. If we add any, we'll name them here and ask for your consent first where the law requires it.

These providers may process personal data only for authorised purposes and subject to appropriate safeguards.

Some of our providers, such as Postmark and Cloudflare, are based outside the UK and may process your data there. We only use a provider outside the UK where UK law allows it, for example where the UK has approved the country's data protection, or where the provider has signed approved contract terms such as the UK International Data Transfer Agreement or UK Addendum. You can ask us which safeguard applies and for a copy, with any confidential parts removed.

Customer account records: account life plus up to 6 years after closure where transaction, prize, complaint or protection records exist.

Internal guest profiles created for postal entry administration: anonymised or closed 60 days after the final associated competition draw, unless another active entry or legal requirement prevents this. A guest profile with no competition entry is closed at our next daily clean-up.

Accepted physical postal correspondence: stored by competition code and securely shredded 60 days after the final accepted winner is found. A legal hold may extend this period.

Rejected and void postal correspondence: counted by reason and securely shredded promptly; personal details from the rejected item are not retained in the rejection log. If an otherwise valid entry is void, we keep only the email address on it until the competition is drawn, use it once to send one summary email, and then delete it. If the competition is not drawn, we delete it within 60 days.

An active accessibility-adjustment flag remains linked to the supplied email until you ask us to remove it or the related account is deleted.

Entries, past quiz records and draw audit records: 6 years after the relevant draw or competition closure.

Payment, refund, Account Credit, Sovereigns and accounting records: 6 years after the relevant financial year end.

Complaints and support records: 6 years after final resolution.

Winner claim and prize fulfilment records: 6 years after fulfilment.

Bank details for prize payments: permanently masked 90 days after the prize is paid, unless needed for an active dispute, fraud review, tax check or legal hold.

Security and audit logs: deleted 24 months after they are created.

Marketing consent and unsubscribe records: duration of consent plus up to 6 years after opt-out or account closure.

Records may be retained longer where required for tax, legal claims, fraud prevention, chargebacks, regulator queries, prize disputes or security investigations.

Depending on the circumstances, you may ask us for access to your personal data, correction, erasure, restriction, portability or to object to processing based on legitimate interests or direct marketing. You may withdraw consent at any time. You also have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

We do not currently make decisions about customers solely by automated means that produce legal or similarly significant effects. Automated security or Player Protection flags are reviewed by an authorised person before significant account action is taken.

If you have an account, you can download a copy of your data from your profile. To make any privacy request, contact [email protected]. We may need proportionate identity evidence. We respond without undue delay and normally within one month; if a permitted extension is needed, we will explain why within the first month. Requests are normally free, subject to the limited exceptions permitted by law.

If we identify a personal data breach, we will assess the risk, take containment steps and keep an internal breach record.

Where UK GDPR requires notification, we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If a breach is likely to result in a high risk to affected individuals, we will also notify affected individuals without undue delay.

You can complain to the Information Commissioner's Office if you are unhappy with how we handle your personal data. You can also contact us first at [email protected] so we can try to resolve your concern.