Privacy Policy
How your information is used, protected and managed.
Who is responsible
Waypoint Wins Limited, company number 17433274, is the controller of personal information used to operate Waypoint Wins. For a privacy enquiry, write to Suite 60, WAYPOINT WINS LIMITED, 1 Ensbury Park Road, Bournemouth BH9 2SQ, United Kingdom, marked “Privacy”. Our registered office is at the same address. For privacy enquiries and data-rights requests, email privacy@waypointwins.co.uk. You do not need to opt into marketing to register or enter.
Information we collect
Account information includes your name, email address, date of birth, address and account preferences. Entry records include competition and ticket identifiers, entry method, order references, payment status, discounts and wallet transactions. Postal entry details are recorded to match the postcard to your account. We also process support correspondence, winner/fulfilment details and responsible-play preferences. If you win and choose a cash payout, we collect the name on your bank account, your sort code and account number. Only authorised staff can see them, we use them only to pay you, and we delete them once the payment is made, keeping just the last four digits as a record. Our hosting and authentication services process technical information needed to operate and secure the service, such as IP addresses, browser details, login events and error logs. We do not ask you to provide card security codes in correspondence, and the current manual-payment checkout does not collect card details.
Purposes and legal bases
We use account, entry and fulfilment information to take steps you request and perform our contract with you. We use payment/accounting and legally required disclosure information to meet legal obligations. Our legitimate interests include preventing fraud, securing accounts, investigating complaints and keeping evidence of fair administration; we balance these against your rights. Optional promotional messages and optional publicity rely on your consent. You can withdraw consent without affecting earlier lawful processing or your eligibility for a prize. We do not use a marketing opt-out as permission to send you promotions. Information needed for an entry, age check or delivery must be provided for that service to work.
Who receives information
We use Namecheap Private Email to send and receive correspondence, including support, privacy and prize enquiries, and the automatic emails confirming your orders, postal entries and wins. The site uses Supabase for authentication and database services and Vercel for hosting. Google Fonts supplies website fonts; loading these may disclose network/device information to Google. When you enter a postcode, our server looks up its county with postcodes.io, an open postcode lookup service; only the postcode is sent. Authorised staff use account and order information to administer entries and fulfil prizes. Relevant details may be shared with a delivery company, confirmed prize supplier, bank/payment service, professional adviser or public authority when needed for that purpose. DNA Payments is being considered through onboarding; this notice does not state that live card processing is already enabled. Before activating a new payment service, the notice must identify its role and applicable privacy information. Winner announcements show a name (or initials) and county, never a full postal address, date of birth, bank details or account email.
Storage, security and international transfers
Access is restricted according to role and information is handled through authenticated services. No online service can promise absolute security. You should use a strong password and protect your account. Service providers may process data outside the UK. Where a restricted transfer occurs, appropriate safeguards or a valid adequacy basis must be documented; the specific hosting regions and transfer arrangements are launch-review items and can be requested from us. We retain information for its operational purpose and applicable legal obligations, not indefinitely by default. Entry/payment and dispute records may need to remain after account closure. A documented retention schedule for accounts, postcards, identity checks, technical logs and marketing records is being finalised before paid launch. Deletion requests will be considered against any legal duty or need to establish, exercise or defend legal claims.
Your choices and rights
Depending on the circumstances, you can request access, correction, deletion, restriction or portability of your data and object to legitimate-interest processing. You have an absolute right to object to direct marketing. Update your marketing preference in your account or contact us. Identity verification may be needed before we disclose or change information. Requests are generally answered within one month; lawful extensions or exceptions will be explained. You may complain to the Information Commissioner's Office at ico.org.uk or call 0303 123 1113. You may contact the ICO without first contacting us. Our service is for adults aged 18 or over, not children.
Automated allocation, winner information and changes
Random ticket allocation and matching confirmed tickets to predetermined prize numbers are automated parts of administering a competition, not personal profiling to determine who deserves a prize. You can ask us to investigate a disputed result or entry. Public results show a main-draw winner's first name and surname, or initials if they choose, with their county, the prize and the winning ticket number. We publish these to show that prizes are genuinely awarded, which is our legitimate interest and what the advertising rules we follow expect. You can switch to initials in My Account at any time, and we will consider any other objection to publication. The Advertising Standards Authority can ask us for a winner's details. Each competition page has a Recent entries list showing how many tickets someone entered and when, with their first name, surname initial and county. It shows that real people are entering, which is our legitimate interest. We never show a full surname, address or email there. You can switch this off in My Account at any time, and your entries then show as "Someone". Our Cookie Policy explains browser storage. This notice will be updated when the actual services or processing arrangements change; material changes will be brought to users' attention where required.