ISLAND COMPETITIONS LTD – PRIVACY POLICY
LAST UPDATED: NOVEMBER 2026
1.1 This Privacy Policy explicitly governs how Island Competitions Ltd ("the Promoter", "us", "we", "our") collects, utilizes, stores, and protects the personal data belonging to individuals ("Customer", "you", "yours", "entrant", "member") interacting with our website www.islandcompetitions.co.uk ("the Website").
1.2 Island Competitions Ltd is a company registered in England and Wales under company number 15205206 (VAT number GB529131109), with its registered office at 57 Seaview Road, Cowes, Isle of Wight, PO31 7UN. We operate as the data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1.3 Data Protection Registration: We are officially registered with the Information Commissioner’s Office (ICO) under registration number ZB771554.
To manage your user account, execute fair free prize draws, process transactions, and maintain compliance, our custom website architecture captures the following data fields:
Account Creation Profile Data: Your full legal name, permanent residential address, date of birth, telephone number, and verified email address.
Platform Security & Session Records: Your account password hashes, device-side IP addresses, unique network login identifiers, browser configurations, and active "Take a Break" account lockout states.
Transactional and System Logs: Detailed tracking records of ticket purchases, specific randomly allocated ticket numbers, transaction IDs, site credit wallet history, and withdrawable wallet balances.
Discretionary Verification Documentation: Copies of government-issued photographic identification (Passport or UK Driving Licence) and utility bills or bank statements used to confirm address matching.
Potential Future Behavioral Analytics: Anonymous or pseudonymous interaction signals that may be tracked via pixels and cookies in the future, including pages viewed, cart abandonment events, and advertisement click metrics.
Under UK GDPR framework guidelines, we rely on the following distinct legal pathways to handle your data safely:
Contractual Necessity: We must process your account profile, ticket metadata, and wallet balances to fulfill our contract with you as an entrant in our prize draws and to distribute won prizes.
Legitimate Interests: We rely on our legitimate business interests to implement account locks (Take a Break/Self-Exclusion vectors), log session states to protect against website bot abuse, monitor platform security parameters, track rolling PayPal spending thresholds, and manage marketing loops via Resend.
Legal Obligation: We process and store transaction receipts, company tax breakdowns, and identity proofs to satisfy our statutory requirements regarding UK Anti-Money Laundering (AML) standards, HMRC reporting, and consumer protections.
Explicit Consent: We request your clear, opt-in consent for dropping non-essential analytics cookies and for utilizing your photographs or win videos on public media networks.
4.1 Payment Security Architecture: Online checkout transactions are entirely processed off-site via the authorized payment page platforms of Cashflows and PayPal. Our React frontend application framework does not view, collect, parse, or store raw credit or debit card numbers, CVV security codes, or digital banking passwords on our local database servers.
4.2 Tokenization and Hook Logs: When an entry transaction executes, Cashflows or PayPal returns a secure token payload and a cryptographic data signal (Webhook or Instant Payment Notification) to our central backend server to validate payment settlement. The processing of billing fields within those secure gateway parameters is governed exclusively by Cashflows’ and PayPal's individual corporate privacy networks.
5.1 Discretionary ID Audits: Pursuant to Clause 16 of our Terms and Conditions, we execute discretionary verification checks prior to processing cash or high-value withdrawals. Where an audit is triggered, entrants are required to transmit digital copies of their photo identification and proof of address to our team via secure official email channels or our authorized corporate WhatsApp business account.
5.2 Strict Data Minimization and Erasure: Identity documents received via email or WhatsApp are handled under strict data-minimization controls. Once our compliance team manually cross-references the documentation to verify that the legal names and addresses perfectly match your account profile, the document files are immediately processed and validated. The source digital image files are then permanently purged and securely erased from our active email server trash arrays and WhatsApp device chat history chains within forty-eight (48) hours of verification completion. We do not maintain any long-term or unsecured storage repositories of your sensitive government documentation.
Our custom build links to a small selection of specialized third-party cloud tools to support operations, performance optimization, and marketing activities:
Resend: We utilize Resend as our primary email delivery infrastructure service provider. Your account name, email address, and transaction status data are shared with Resend to automate your official purchase receipts, issue ticket allocation numbers, and distribute our optional promotional marketing updates.
Google Analytics (Potential Future Deployment): We may integrate this tool in the future to drop persistent analytical cookies into your browser. This will help us analyze how users navigate our site interface, measure load failures across our custom React components, and optimize application accessibility parameters.
Meta / Facebook Pixel (Potential Future Deployment): We integrate this script in the future to record custom conversion metrics on our checkout success pages to optimize our social media advertising spend and measure the effectiveness of our promotion runs.
BACS Processing Links: Your name and bank routing coordinates are shared exclusively with our clearing banking networks to execute verified cash withdrawal transfers from your site wallet.
Essential session cookies required to persist your secure wallet logins and transaction flows execute automatically. If deployed in the future, non-essential tracking scripts belonging to third-party tools such as Google Analytics and Meta Pixel will remain completely blocked from launching or dropping browser tracking variables until you explicitly grant active consent via our opt-in banner interface. Once that banner is in use, you can dynamically adjust your tracking preferences at any time by using the "Cookie choices" link in our website footer.
8.1 Data Borders: All core user account parameters, relational database indices, and wallet transaction tables are safely stored on secure cloud hardware nodes physically localized inside the United Kingdom or the European Economic Area (EEA).
8.2 Retention Timeframes: We hold your active profile records, wallet histories, and ticket log files for as long as your site account remains active. If you request account closure or remain entirely inactive for a prolonged period, your transaction records are retained for a mandatory statutory period of seven (7) years to ensure complete compliance with HMRC financial audits and corporate legal record tracking requirements, after which they are permanently anonymized or shredded from our server arrays.
You possess comprehensive, enforceable legal privileges regarding your personal profile information held in our databases, including:
The Right of Access: You can request a complete copy of all personal data fields we hold concerning your account at any time.
The Right to Rectification: You can demand the immediate correction of variables.
The Right to Erasure ("Right to be Forgotten"): You can request the destruction of your profile, subject to our statutory HMRC 7-year retention requirements for paid financial logs.
The Right to Restrict Processing: You can ask us to pause the processing of your data while an accuracy dispute is being evaluated.
The Right to Data Portability: You can request that your database records be structured into a machine-readable JSON or CSV format.
The Right to Object: You can opt out of any automated promotional emails by clicking the unsubscribe link handled inside our Resend automated mail footer.
To formally invoke any of these statutory consumer data privileges, simply transmit your written request to our support desk via your account email.
If you have questions about this policy, or if you believe our platform has mismanaged your privacy variables, you have the absolute legal right to lodge a formal complaint with the UK supervisory authority:
The Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113 / Website: www.ico.org.uk