Privacy Policy

CROWN AND EAGLE COMPETITIONS LTD, trading as Crown & Eagle Competitions, is the controller responsible for personal data processed through the Crown & Eagle Competitions website. The registered address is 6, East Grove Road, Newport, NP19 9QG. Company number: 17307252. ICO registration number: ZC195820.

Privacy contact: [email protected].

We may collect account details, contact details, age and identity verification information, address details, login records, competition entries, quiz attempts, payment records, refund records, Account Credit records, Sovereigns activity, complaint records, support messages, handwritten or authorised typed postal entry information, accessibility-adjustment status linked to an email address, winner claim details, bank details for withdrawals or prize payments, device information, security information and website usage data. We do not require a diagnosis or medical details to record a postal-entry accessibility adjustment.

• Contract: creating and managing an account; checking eligibility; operating competitions and the skill question; processing entries, payments, refunds, Account Credit and Sovereigns; contacting entrants about their entries; verifying winners; and delivering prizes.
• Legal obligation: tax and accounting records; responding to regulators and lawful requests; handling data-rights requests; and meeting duties relating to fraud, financial records and personal-data breaches.
• Legitimate interests: securing the website and accounts; preventing and investigating fraud, duplicate accounts, payment abuse and rule breaches; enforcing Player Protection controls; resolving complaints and legal claims; maintaining draw and operational audit records; and improving service reliability. Our interests are safe, fair and accountable operation. We balance these interests against the effect on customers and provide a right to object.
• Consent: each optional category of marketing email and each non-essential cookie category. Consent can be withdrawn at any time without affecting earlier lawful processing.

We do not rely on consent for processing that is necessary to provide an account or competition entry. If we need to use personal data for a materially different purpose, we will explain that purpose and the applicable lawful basis before doing so.

Most personal data comes directly from you. We may also receive payment, authorisation status and fraud signals from our payment processor, your bank or another payment provider displayed at checkout, delivery information from postal or prize providers, referral information from another customer, and security or verification results from providers used for those purposes.

Name, email address, date of birth and credentials are contractually required to create an account. Entry, payment and eligibility information is required when you enter a competition; delivery or bank information is required only where needed to provide a prize or withdrawal. If required information is not provided, we may be unable to create the account, accept an entry, process a payment or withdrawal, verify eligibility, or deliver a prize. Marketing choices and non-essential cookies are optional and do not affect access to the core service.

Card payments are handled by a third-party, PCI-DSS compliant payment processor, whether by redirecting you to its own secure payment page or via payment fields it hosts directly within our checkout.

We receive and retain payment identifiers, amounts, currency, status changes, failure, refund and chargeback information needed to confirm or withdraw entries and reconcile payments. If a card or another payment option is displayed, its named provider may process equivalent payment and security information; we do not store full payment card numbers.

Where Account Credit withdrawals, refunds or winner claim payments require bank details, those details are used only for the relevant payment, verification, fraud prevention, accounting and compliance purposes.

Bank details should be available only to authorised users and should be deleted or irreversibly masked when no longer needed, unless they must be kept for an active dispute, fraud review, accounting requirement, tax check or legal hold.

The website may keep draw records, eligible entry hashes, payment totals, refund records, quiz pass and fail statistics, question performance records, blocked Player Protection limit attempts, suspended account access attempts and operational audit logs.

These records help demonstrate fairness, security, responsible operation, dispute handling and compliance.

We may publish limited winner information where this is necessary to demonstrate that a competition has been completed fairly. This may include a winner name or initials, general location, prize details and winning entry reference.

We will not publish unnecessary personal contact details.

Service messages about your account, entries, payments, complaints, Player Protection settings or competition administration are not marketing.

Optional marketing emails are sent only for the categories you actively select. Registration is not automatic marketing consent.

You can unsubscribe using the link in an email or change individual choices in your profile. We keep consent and unsubscribe records so we can demonstrate and respect your choices.

Service providers may include our payment processor and any other payment provider displayed at checkout for payment processing, reconciliation and fraud prevention, Brevo for automated or transactional email delivery and any marketing emails where enabled, DigitalOcean for website or server hosting, database hosting providers, domain/DNS/security providers, postal services, prize delivery providers, fraud/age-verification providers where used, a bank account checking provider (which receives the sort code and account number you enter for a withdrawal or cash prize, to confirm they match a UK bank account), and professional advisers such as accountants, solicitors and insurers.

No analytics, advertising pixels, heatmap tools or affiliate trackers are currently listed as active. If analytics, advertising pixels, heatmaps, affiliate trackers or other marketing tools are added in future, they should be named in this policy and used only with consent where required.

These providers may process personal data only for authorised purposes and subject to appropriate safeguards.

Some service providers may process data outside the United Kingdom. Before a restricted transfer, we identify the destination and recipient and use an applicable UK adequacy regulation or approved contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with a transfer risk assessment and supplementary safeguards where required. You may ask the privacy contact for information about the safeguard used and how to obtain a copy, subject to necessary redactions.

Customer account records: account life plus up to 6 years after closure where transaction, prize, complaint or protection records exist.

Internal guest profiles created for postal entry administration: anonymised or closed 60 days after the final associated competition draw, unless another active entry or legal requirement prevents this. A guest profile with no competition entry is closed when its processing session ends.

Accepted physical postal correspondence: stored by competition code and securely shredded 60 days after the final accepted winner is found. A legal hold may extend this period.

Postbox Prize Draw postal correspondence: stored by month and securely shredded 60 days after the final accepted winner for that month is found. A legal hold may extend this period.

Rejected postal correspondence: counted by rejection reason and securely shredded promptly; personal details from the rejected item are not retained in the rejection log. If an otherwise valid entry arrives after the closing date, we use the email address on it once to tell the entrant, and do not keep it.

An active accessibility-adjustment flag remains linked to the supplied email until you ask us to remove it or the related account is deleted.

Entries, quiz pass records and draw audit records: 6 years after the relevant draw or competition closure.

Payment, refund, Account Credit, Sovereigns and accounting records: 6 years after the relevant financial year end.

Complaints and support records: 6 years after final resolution.

Winner claim and prize fulfilment records: 6 years after fulfilment.

Bank details for withdrawals or prize payments: target deletion or irreversible masking within 90 days after payment and reconciliation, unless needed for an active dispute, fraud review, tax check or legal hold.

Security and audit logs: normally 12 to 24 months, longer for active investigations.

Marketing consent and unsubscribe records: duration of consent plus up to 6 years after opt-out or account closure.

Records may be retained longer where required for tax, legal claims, fraud prevention, chargebacks, regulator queries, prize disputes or security investigations.

Depending on the circumstances, you may ask us for access to your personal data, correction, erasure, restriction, portability or to object to processing based on legitimate interests or direct marketing. You may withdraw consent at any time. You also have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

We do not currently make decisions about customers solely by automated means that produce legal or similarly significant effects. Automated security or Player Protection flags are reviewed by an authorised person before significant account action is taken.

Verified account holders can download a JSON data export from the profile area. To make any privacy request, contact [email protected]. We may need proportionate identity evidence. We respond without undue delay and normally within one month; if a permitted extension is needed, we will explain why within the first month. Requests are normally free, subject to the limited exceptions permitted by law.

If we identify a personal data breach, we will assess the risk, take containment steps and keep an internal breach record.

Where UK GDPR requires notification, we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If a breach is likely to result in a high risk to affected individuals, we will also notify affected individuals without undue delay.

You can complain to the Information Commissioner's Office if you are unhappy with how we handle your personal data. You can also contact us first at [email protected] so we can try to resolve your concern.