Who we are
, trading as Forté Prizes, is the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our registration with the Information Commissioner's Office (ICO) is in progress, and we will add our registration number here once it is issued. Contact our privacy team at or write to .
What we collect
- Identity: name, date of birth, and the results of age and identity checks.
- Contact: email, phone number and postal address.
- Entries: competitions entered, answers, Spot the Ball coordinates, entry numbers and postal entries.
- Payments: amounts, dates and the last four digits of your card. Full card details are handled by our payment provider, not by us.
- Safer play: your spending limits, pauses, suspensions, and signs of harm we notice.
- Technical: IP address, device and browser information, and cookies (see our Cookie Policy).
- Communications: messages with our support team, and your marketing choices.
How we use it and why
| Purpose | Lawful basis |
|---|---|
| Running competitions, taking entries, judging and awarding prizes | Contract |
| Checking your age, identity and eligibility | Legal obligation and legitimate interests (preventing under-18 entry and fraud) |
| Spending limits, monitoring for signs of harm, suspensions | Legitimate interests (protecting players, following the DCMS Prize Draw Code) |
| Publishing winners' first name and county | Legitimate interests (showing prizes are genuinely awarded, as the CAP Code requires) |
| Marketing emails about new competitions | Consent, which you can withdraw at any time |
| Keeping financial and tax records | Legal obligation |
| Analytics cookies | Consent |
Who we share it with
- Our payment provider [e.g. Stripe], to take payments.
- Our age and identity verification provider [provider].
- Our email and hosting providers, who process data only on our instructions.
- Our independent draw supervisor or auditor, who sees entry numbers but not your contact details.
- Delivery companies, to deliver prizes.
- Regulators, the police or courts, where the law requires.
We never sell your data. Where a provider stores data outside the UK, we use UK-approved safeguards such as the International Data Transfer Agreement.
How long we keep it
- Entry, payment and winner records: 6 years after the end of the financial year in which the competition closes, as required by HMRC and the Companies Act 2006, and within the 6-year limitation period for claims under the Limitation Act 1980.
- Age and identity check results: 6 years, or less if the law requires.
- Safer play records (suspensions and closures): as long as needed to keep the suspension working, and at least 6 months.
- Account details with no entries: 2 years after your last sign-in, then deleted.
- Support messages and complaints: 3 years after they are closed.
- Marketing data: until you unsubscribe, then kept only on a suppression list so we don't contact you again.
- Analytics data: 14 months in Google Analytics.
We keep data only for as long as we need it, as UK GDPR requires. When it is no longer needed, we delete it securely or anonymise it.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, limit how we use it, object to how we use it, or move it to another service. You can withdraw consent at any time. Email . We reply within one month.
If you are unhappy with how we handle your data, you can complain to the ICO at ico.org.uk or on 0303 123 1113.
Children
Our services are not for anyone under 18. If we learn we have collected data from someone under 18, we close the account, refund any entries and delete the data we don't need to keep.
Security
We use encryption in transit (HTTPS), access controls and trusted providers to protect your data. No system is completely secure, so tell us straight away if you think your account has been used by someone else.