Privacy Policy
1. Introduction
This Privacy Policy explains how Mills Competitions Ltd (“we”, “us”, “our”), trading as R8ffle, collects, uses, stores, and protects your personal data when you create an account, enter competitions, or interact with our website. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
By using our website, you agree to the practices described in this policy.
2. Data We Collect
We collect the following categories of personal data:
Account Information: Full name, email address, phone number, postal address.
Competition Data: Entries, answers to skill‑based questions, order history.
Winner Verification: Government‑issued ID, proof of insurance (for vehicle prizes), and any additional documentation required to confirm eligibility.
Payment Information: Processed securely by third‑party payment providers; we do not store card details.
Technical Data: IP address, device information, browser type, and usage data for fraud prevention and site security.
Communications: Emails, messages, and customer service interactions.
This data is necessary to operate competitions in accordance with our Terms & Conditions.
3. How We Use Your Data
We process personal data for the following purposes:
Competition Entry & Administration: Managing entries, validating answers, conducting draws, and awarding prizes.
Winner Verification: Ensuring eligibility and preventing fraud.
Account Management: Maintaining your profile and purchase history.
Marketing Communications:
Soft opt‑in emails about similar competitions you’ve entered before.
SMS marketing only if you explicitly opt in.
Legal & Regulatory Compliance: Record‑keeping, tax obligations, and compliance with ASA requirements.
Website Security: Fraud detection, system monitoring, and preventing misuse.
Legal bases for processing include contractual necessity, legitimate interests, and legal obligations.
4. Marketing & Communication Preferences
4.1 Soft Opt‑In Email Marketing: We may email you about similar competitions you have previously entered. You can unsubscribe at any time.
4.2 SMS Marketing: We will only send SMS marketing messages if you have explicitly opted in via the checkbox at checkout.
4.3 Service Emails: Unsubscribing from marketing does not affect essential service emails such as order confirmations, account updates, or winner notifications.
4.4 No Data Selling: We never sell or share your data with third parties for their own marketing purposes.
4.5 You can update your marketing and communication preferences anytime via ‘My Account’.
5. Data Sharing
We only share your data with trusted third parties where necessary to operate our service:
Payment processors
Website hosting and security providers
Identity verification services
Delivery partners (for prize fulfilment)
Legal or regulatory authorities when required
All third‑party partners operate under GDPR‑compliant agreements.
We do not share your data for external marketing.
6. Winner Publicity
To comply with ASA rules and maintain transparency:
We may publish the surname and county of major prize winners.
Winners may be invited to participate in optional photos or videos for social media.
Winners may request reasonable anonymity where justified (e.g., safety concerns).
Winner information may be displayed for up to 12 months unless required longer for regulatory reasons.
You can ask about anonymity using winner privacy options.
7. Data Retention
We retain personal data only for as long as necessary:
Account and entry data: up to 6 years (legal and accounting requirements)
Winner verification documents: up to 12 months unless legally required longer
Marketing preferences: until you unsubscribe
Technical logs: typically 30–180 days, depending on security needs
After these periods, data is securely deleted or anonymised.
8. Your Rights Under UK GDPR
You have the following rights:
Access your personal data
Correct inaccurate information
Delete your data (where legally permitted)
Restrict processing
Object to processing (including marketing)
Data portability (receive your data in a transferable format)
To exercise these rights, contact us via the details on our website or submit a data rights request.
9. Data Security
We use appropriate technical and organisational measures to protect your data, including:
Encrypted connections (HTTPS)
Secure servers
Access controls
Fraud‑prevention systems
Regular security monitoring
While no system is completely secure, we take all reasonable steps to safeguard your information.
10. Cookies & Analytics
Our website uses cookies to:
Enable essential site functionality
Improve user experience
Support fraud prevention and security
Analyse website performance
You can manage your cookie preferences through your browser settings or our cookie banner.
11. Contact Information
For privacy‑related requests or questions, please contact us using the details provided on our website.