Privacy Policy

PRIVACY POLICY

WINTHELUXE LTD, How we handle your personal data

Last updated: 17 April 2026 | Version: 1.0

1. Who We Are

WINTHELUXE LTD (« we », « us » or « our ») is the data controller for personal data collected through the website at https://wintheluxe.com. We are a company incorporated in England and Wales under company number 17165386, with registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

We are registered with the UK Information Commissioner’s Office (ICO) under registration number ZC131713.

Our Data Protection contact can be reached at contact@wintheluxe.com for any privacy-related question or request.

2. Scope Of This Policy

This Privacy Policy explains how we collect, use, share, store and protect personal data when you visit our website, create an account, enter a competition, contact us or interact with us on social media.

This Policy is written in accordance with the UK General Data Protection Regulation (« UK GDPR »), the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation (« EU GDPR ») for visitors based in the European Economic Area.

3. Personal Data We Collect

We collect and process the following categories of personal data:

• Identity data: full legal name, date of birth, gender (if provided), nationality;

• Contact data: email address, postal address, telephone number;

• Account data: username, password (hashed), account preferences, communication preferences;

• Competition data: entries made, skill question answers, payment records, prize history;

• Payment data: payment method type, last four digits of card, billing address (we do not store full card details, these are processed by our payment provider Stripe);

• Technical data: IP address, browser type and version, device type, operating system, time zone, referring URL;

• Usage data: pages visited, time spent, buttons clicked, entries started but not completed;

• Marketing data: your preferences on receiving marketing from us, responses to marketing communications;

• Verification data where required: copies of identity documents, proof of address, for Winners only.

4. How We Collect Your Data

We collect data directly from you when you register an account, enter a competition, contact customer support, respond to surveys or marketing, or communicate with us by email, phone or social media.

We also collect data automatically through cookies and similar technologies when you browse the Website. See our Cookie Policy at https://wintheluxe.com/cookie-policy for full details.

In limited circumstances, we may receive data from third parties such as payment providers, identity verification providers, and marketing partners, where you have consented to such sharing.

5. Legal Bases For Processing

We process personal data on the following legal bases:

• Performance of a contract: where processing is necessary to provide the services you have requested (for example, to process your competition entries, deliver prizes, manage your account);

• Compliance with a legal obligation: where we are required by law to retain records (for example, tax, accounting, anti-money laundering);

• Legitimate interests: where processing is necessary for our legitimate business interests and does not override your rights (for example, fraud prevention, service improvement, direct marketing to existing customers);

• Consent: where you have given clear consent (for example, marketing emails to new subscribers, non-essential cookies). You may withdraw consent at any time.

6. How We Use Your Data

We use personal data for the following purposes:

• Operating our competitions, processing entries and conducting draws;

• Notifying winners, verifying identity and delivering prizes;

• Managing your account, authenticating log-ins and providing customer support;

• Processing payments and issuing receipts;

• Preventing fraud, abuse, money laundering and multiple-account creation;

• Monitoring for signs of harm or distress and providing responsible play support where appropriate;

• Complying with legal and regulatory obligations including ICO, HMRC and DCMS requirements;

• Sending transactional communications (entry confirmations, draw results, account security);

• Sending marketing communications where you have consented or where permitted by the soft opt-in;

• Analysing Website usage to improve our services;

• Defending or pursuing legal claims.

7. Marketing Communications

We may send you marketing communications about our competitions, prizes and related offers by email, SMS, WhatsApp, push notification or post. We will only do so where you have given consent, or where you have previously entered a competition (soft opt-in) and have not opted out.

Every marketing communication contains a clear and easy method to opt out. You may also manage your preferences at any time in your account settings, or by emailing contact@wintheluxe.com.

We do not sell or rent personal data to third parties for marketing purposes.

8. Sharing Your Data

We share personal data only with trusted third parties who provide services necessary to operate our competitions. These include:

• Payment processors (Stripe, Apple Pay, Google Pay);

• Random Number Generator providers for certified draw selection;

• Email and SMS delivery platforms;

• Customer support platforms;

• Hosting and cloud infrastructure providers;

• Analytics providers (see Cookie Policy);

• Identity verification providers (for prize winners only);

• Travel suppliers and concierge partners (strictly limited to the data needed to deliver the prize);

• Professional advisors (lawyers, accountants, auditors);

• Law enforcement, regulators or courts where required by law.

All third-party processors are subject to written agreements requiring appropriate security, confidentiality and data protection standards.

9. International Transfers

Some of our service providers are based outside the United Kingdom or the European Economic Area. Where we transfer personal data to such providers, we rely on one of the following safeguards recognised by the UK GDPR:

• Adequacy decision by the UK or EU;

• Standard Contractual Clauses approved by the ICO or the European Commission, together with the UK International Data Transfer Addendum where applicable;

• Binding Corporate Rules, where in force.

You may request a copy of the safeguards in place for any specific transfer by contacting contact@wintheluxe.com.

10. Data Retention

We retain personal data only for as long as necessary for the purposes set out in this Policy, or as required by law.

• Account data: for the duration of the account plus 6 years after closure, to meet legal and accounting obligations;

• Competition entries and payment records: 6 years, in line with HMRC and statute of limitations requirements;

• Winner verification documents: 6 years after prize delivery;

• Marketing preferences: until you withdraw consent, plus 12 months for audit purposes;

• Customer support correspondence: 3 years from the date of resolution;

• Technical and usage data: 24 months in identifiable form, then aggregated or deleted;

• Self-exclusion records: indefinitely, in accordance with responsible play standards.

Data is deleted or anonymised at the end of the relevant retention period, save where a longer retention is required by law.

11. Your Rights

Under UK GDPR and the Data Protection Act 2018, you have the following rights:

• Right of access: to request a copy of the personal data we hold about you;

• Right to rectification: to have inaccurate or incomplete data corrected;

• Right to erasure (« right to be forgotten »): to request deletion of your data in certain circumstances;

• Right to restriction of processing: to limit how we use your data;

• Right to data portability: to receive your data in a structured, machine-readable format;

• Right to object: to processing based on legitimate interests or for direct marketing;

• Right to withdraw consent: where processing is based on consent;

• Right not to be subject to automated decision-making that produces legal effects, save where specifically permitted by law.

To exercise any of these rights, please email contact@wintheluxe.com. We will respond within one calendar month. There is no fee unless the request is manifestly unfounded or excessive.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office at www.ico.org.uk or by calling 0303 123 1113. If you reside in the EEA, you may complain to your local supervisory authority.

12. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction or damage. These measures include encryption in transit (TLS) and at rest, access controls, logging, regular security reviews and staff training.

Despite these measures, no system is entirely secure. In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where the risk is high, notify you directly without undue delay.

13. Children

Our services are not intended for persons under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly.

If you believe a child has provided us with personal data, please contact contact@wintheluxe.com.

14. Changes To This Policy

We may update this Privacy Policy from time to time. The latest version is always available at https://wintheluxe.com/privacy-policy with the last updated date shown at the top. Where changes are material, we will notify you by email or through a prominent notice on the Website.

15. Contact

For any question, request or concern relating to your personal data, please contact:

Email: contact@wintheluxe.com

Post: Data Protection, WINTHELUXE LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, United Kingdom.

ICO registration: ZC131713

END OF PRIVACY POLICY