Version: 1.0 Effective Date: 12 August 2026

1. Purpose 

1.1 This Privacy Policy (“the Policy”) explains how Magpie Competitions (“the Company”) collects, uses, stores, and protects personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. 

1.2 The Policy ensures transparency, accountability, and lawful processing of personal data relating to participants, winners, and website users. 

2. Scope 

2.1 This Policy applies to all personal data processed by the Company; 

2.2 This Policy applies to all competitions, website interactions, customer service communications, winner verification processes, and prize fulfilment activities; 

2.3 This Policy applies to all staff involved in data handling. 

3. Data Controller 

3.1 Magpie Competitions is the data controller responsible for determining the purposes and means of processing personal data; 

3.2 Contact details are provided in Section 16. 

4. Categories of Personal Data Collected 

4.1 The Company may collect the following personal data: 

(a) full name 

(b) email address; 

(c) postal address; 

(d) telephone number; 

(e) date of birth (where required for verification); 

(f) payment information (processed securely by third‑party providers); 

(g) IP address and device information; 

(h) competition entry details; 

(i) identification documents (passport or driving licence) for winner verification; 

 4.2 The Company does not collect special category data unless required by law. 

5. Lawful Basis for Processing 

5.1 The Company processes personal data under the following lawful bases: 

(a) Contract – to administer competition entries and fulfil prizes; 

(b) Consent – for marketing communications; 

(c) Legal Obligation – to comply with regulatory requirements; 

(d) Legitimate Interests – to operate competitions fairly, prevent fraud, and maintain website security; 

 5.2 Participants may withdraw consent for marketing at any time. 

6. How Personal Data Is Used 

6.1 The Company uses personal data for the following purposes: 

(a) processing competition entries; 

(b) verifying eligibility and age; 

(c) contacting winners; 

(d) fulfilling prizes; 

(e) maintaining audit trails; 

(f) responding to enquiries and complaints; 

(g) improving website functionality; 

(h) preventing fraud and misuse; 

6.2 Personal data will not be used for automated decision‑making. 

7. Winner Verification 

7.1 The Company may request identification documents from winners under risk‑based criteria;  

7.2 Identification documents are used solely to confirm age and eligibility; 

7.3 Identification documents are retained for no longer than six (6) months and then permanently deleted. 

8. Marketing Communications 

8.1 Participants may opt‑in to receive marketing communications;  

8.2 Marketing may include: 

(a) competition updates; 

(b) promotions; 

(c) winner announcements; 

(d) new product information; 

8.3 Participants may unsubscribe at any time via email or website settings. 

9. Sharing of Personal Data 

9.1 The Company may share personal data with: 

(a) payment processors (e.g., Stripe, PayPal); 

(b) delivery partners or suppliers (with winner consent); 

(c) IT service providers; 

(d) regulatory authorities where legally required;  

9.2 The Company will never sell personal data;  

9.3 Data shared with third parties will be limited to what is necessary for the intended purpose. 

9.4 Systems, Plugins, and Service Providers used:

Magpie Competitions uses the following systems, plugins, and service providers to operate the website, process entries, manage communications, and ensure security: 

Core Website & Ecommerce Systems 

• (a) WordPress – website content management and hosting infrastructure; (b) WooCommerce – order processing, competition entry management, customer accounts, and transactional emails; (c) WooCommerce Stripe Gateway – secure processing of debit and credit card payments; (d) Raffle for WooCommerce – management of raffle entries, ticket generation, QR validation, and winner selection; 

Email & Communication Systems 

(e) WP Mail SMTP – ensures reliable delivery of transactional emails (order confirmations, password resets, winner notifications); (f) MailPoet & MailPoet Premium – newsletter creation, marketing emails, subscriber management, and automation; (g) Microsoft Outlook / Microsoft 365 – customer service communications and support enquiries; 

Security, Anti‑Spam & Compliance 

(h) Akismet Anti‑Spam – protects forms and comments from spam submissions; (i) WPConsent – cookie banner, consent management, script blocking, and privacy compliance tools; (j) Jetpack – security monitoring, brute‑force protection, backups, and performance optimisation; 

Website Functionality & Enhancements 

(k) Advanced Custom Fields – custom data fields used for website structure and competition information; (l) Code Snippets – site‑specific functionality enhancements; (m) Gravatar Enhanced – avatar display improvements for user accounts; (n) HurryTimer – countdown timers for competitions and promotional urgency; (o) PopupKit – pop‑up messages for marketing, announcements, and user engagement; (p) Page Optimize – optimisation of CSS and JavaScript for faster page loading; (q) WPForms Lite – contact forms and enquiry submissions; 

Hosting & Infrastructure 

(r) WordPress.com Hosting – secure storage of website files, databases, backups, and security logs; 

External Platforms 

(s) Social media platforms (Facebook, Instagram, TikTok) – used for marketing, winner announcements, and customer interaction. 

All systems process data in accordance with UK GDPR and their own privacy policies. Data shared with these providers is limited to what is necessary for service delivery and website functionality. 

10. International Transfers 

10.1 Personal data may be transferred outside the UK where required for service provision;  

10.2 The Company ensures that appropriate safeguards are in place, including standard contractual clauses or equivalent protections. 

11. Data Retention 

11.1 Personal data will be retained only for as long as necessary to fulfil the purposes outlined in this Policy;  

11.2 Retention periods include: 

(a) competition entry records – up to six (6) years; 

(b) identification documents – up to six (6) months; 

(c) customer service communications – up to two (2) years; 

(d) marketing preferences – until consent is withdrawn; 

11.3 Data will be securely deleted or anonymised after retention periods expire. 

12. Data Security 

12.1 The Company implements appropriate technical and organisational measures to protect personal data, including: 

(a) encryption; 

(b) secure servers; 

(c) restricted access controls; 

(d) regular security reviews;  

12.2 Staff must follow all internal data‑protection procedures. 

13. Participant Rights 

13.1 Participants have the following rights under UK GDPR: 

(a) right to access personal data; 

(b) right to rectification; 

(c) right to erasure (“right to be forgotten”); 

(d) right to restrict processing; 

(e) right to data portability; 

(f) right to object; 

(g) right to withdraw consent; 

13.2 Requests will be responded to within one (1) month. 

14. Cookies and Website Tracking 

14.1 The Company uses cookies to improve website functionality and user experience.

14.2 Cookies may collect: 

(a) device information; 

(b) browsing behaviour; 

(c) session data; 

14.3 Participants may manage cookie preferences through browser settings. 

15. Complaints 

15.1 Participants may raise concerns regarding data protection by contacting the Company; 

15.2 Participants may also lodge complaints with the Information Commissioner’s Office (“ICO”). 

16. Contact Information 

Magpie Competitions Office 1, Izabella House 24–26 Regent Place Birmingham B1 3NJ

Email: hello@magpiecomps.co.uk