Privacy Policy
Last Updated: July 2026
1. Who we are
CARD VAULT COLLECTIBLES LTD, trading as WinTheCard (“we”, “us”, “our”), a company registered in England and Wales (company number 17330317, registered office 128 City Road, London EC1V 2NX, United Kingdom), operates the website https://winthecard.com (the “Website”) and the skill-based prize competitions offered on it (the “Services”).
We are the data controller of your personal data for the purposes of UK data protection law, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.
Contact for privacy matters: hello@winthecard.com
We are the data controller of your personal data for the purposes of UK data protection law, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.
Contact for privacy matters: hello@winthecard.com
2. Personal data we collect
Data you provide to us: - Entry details: name, email address, telephone number and postal address, collected during the checkout process operated through our payment provider, Stripe, or when joining our waitlist. Your date of birth is collected only where required for winner verification. - Entry data: competitions entered, tickets purchased, your answers to skill challenges and the time of submission. - Payment data: payment card details are collected and processed directly by our payment provider, Stripe (stripe.com/privacy); we do not store full card numbers. We retain transaction records (amount, date, last four digits, payment reference). - Verification (KYC) data: where required, copies of photographic identification, proof of age and proof of address. - Communications: messages you send us (email, contact forms, social media) and, where applicable, records of calls. - Marketing preferences: your choices about receiving marketing from us. - Publicity materials: where you consent as a winner, photographs, videos and testimonials.
Data we collect automatically: - Technical data: IP address, device type, browser, operating system, approximate location (country-level), and usage data about how you interact with the Website. - Cookies and similar technologies: see our Cookies Policy.
Data we collect automatically: - Technical data: IP address, device type, browser, operating system, approximate location (country-level), and usage data about how you interact with the Website. - Cookies and similar technologies: see our Cookies Policy.
3. How and why we use your personal data
Our website and services are intended solely for individuals who are at least eighteen (18) years old.
We do not knowingly collect personal information from children under the age of 18. If we become aware that personal information has been submitted by a person under 18, we reserve the right to delete such information immediately.
We do not knowingly collect personal information from children under the age of 18. If we become aware that personal information has been submitted by a person under 18, we reserve the right to delete such information immediately.
4. Who we share your data with
We share personal data, only to the extent necessary, with:
- Payment service providers (Stripe) to process your payments and provide checkout;
- Identity verification providers to carry out KYC checks;
- Couriers and insurers to deliver prizes;
- Independent promotional verification services to conduct and verify draws;
- IT, hosting, analytics and communication providers who support the operation of the Website;
- Professional advisers (lawyers, accountants, auditors);
- Regulators, law enforcement and other authorities where required by law or to protect our rights, including where we suspect fraud or unlawful activity;
- A buyer or successor in the event of a sale, merger or reorganisation of our business.
We do not sell your personal data.
- Payment service providers (Stripe) to process your payments and provide checkout;
- Identity verification providers to carry out KYC checks;
- Couriers and insurers to deliver prizes;
- Independent promotional verification services to conduct and verify draws;
- IT, hosting, analytics and communication providers who support the operation of the Website;
- Professional advisers (lawyers, accountants, auditors);
- Regulators, law enforcement and other authorities where required by law or to protect our rights, including where we suspect fraud or unlawful activity;
- A buyer or successor in the event of a sale, merger or reorganisation of our business.
We do not sell your personal data.
5. International transfers
Some of our service providers may process personal data outside the UK. Where they do, we ensure appropriate safeguards are in place, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
6. How long we keep your data
Entry and competition data: up to 6 years from the end of the relevant competition, to dealwith queries, disputes and legal claims;
Transaction records: at least 6 years, to comply with tax and accounting obligations;
KYC documents: 5 years from collection, unless a longer period is required bylaw;
Winner records: at least 6 years, including publication of surname and county forat least 1 month after each competition as required by the CAP Code;
Marketing data: until you opt out or your consent lapses.
Transaction records: at least 6 years, to comply with tax and accounting obligations;
KYC documents: 5 years from collection, unless a longer period is required bylaw;
Winner records: at least 6 years, including publication of surname and county forat least 1 month after each competition as required by the CAP Code;
Marketing data: until you opt out or your consent lapses.
7. Your rights
Under UK GDPR you have the right to:
• access the personal data we hold about you;
• rectify inaccurate or incomplete data;• erase your data in certain circumstances;
• restrict or object to processing in certain circumstances, including an absolute right to object to direct marketing;• data portability in certain circumstances;
• withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal.
To exercise any of these rights, contact us at hello@winthecard.com.
We will respond within one month. We may need to verify your identity before acting on a request.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
We would appreciate the chance to address your concerns first.
• access the personal data we hold about you;
• rectify inaccurate or incomplete data;• erase your data in certain circumstances;
• restrict or object to processing in certain circumstances, including an absolute right to object to direct marketing;• data portability in certain circumstances;
• withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal.
To exercise any of these rights, contact us at hello@winthecard.com.
We will respond within one month. We may need to verify your identity before acting on a request.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
We would appreciate the chance to address your concerns first.
8. Children
The Services are strictly for persons aged 18 or over. We do not knowingly collect personal data from anyone under 18. If we become aware that we hold data about a person under 18, we will delete it and void any associated entries.
9. Security
We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit, access controls and staff confidentiality obligations. No system is completely secure.
10. Changes to this policy
We may update this Privacy Policy from time to time. The “Last Updated” date at the top indicates the latest version. Material changes will be notified via the Website or by email.
11. Contact
CARD VAULT COLLECTIBLES LTD
Email: hello@winthecard.com
Post: CARD VAULT COLLECTIBLES LTD (WinTheCard), 128 City Road, London EC1V 2NX, United Kingdom
Email: hello@winthecard.com
Post: CARD VAULT COLLECTIBLES LTD (WinTheCard), 128 City Road, London EC1V 2NX, United Kingdom