Privacy Policy

Ultimate Football Raffles ("UFR", "we", "us", "our") operates ultimatefootballraffles.com, a skill-based prize competition platform based in the United Kingdom. This Privacy Policy explains how we collect, use, store and protect your personal data, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For all data-protection matters, our controller and contact point is: Ultimate Football Raffles, First Floor, Unit L, Alma Park, Wibtoft, Leicestershire, LE17 5BH, United Kingdom — Support@ultimatefootballraffles.com.

• Account data — your name, email address and encrypted password.
• Entry data — the competitions you enter, tickets purchased, ticket numbers, trivia answers and postal entries.
• Payment data — processed securely by our third-party payment provider. We do not store or have access to your full card number, CVV or expiry date. We only retain a transaction reference and status.
• Technical data — IP address, browser type, device information and cookies (see section 8).
• Communications — any correspondence you send to us (e.g. support emails).

Under UK GDPR we only process your personal data where we have a lawful basis to do so:

• Performance of a contract — to create and manage your account, process entries, take payment, run draws and deliver prizes.
• Legal obligation — to comply with accounting, tax, anti-fraud and consumer-protection laws.
• Legitimate interests — to secure our platform, prevent fraud and chargeback abuse, and improve our service. We balance these interests against your rights.
• Consent — to send you marketing about future competitions (where you opt in) and for non-essential cookies. You can withdraw consent at any time.

All card payments are handled by an FCA-regulated, PCI-DSS compliant third-party payment provider. Card details are entered on the provider's secure infrastructure and are never transmitted to or stored on UFR's servers. Transactions are protected by TLS encryption and, where offered by your bank, 3-D Secure (Strong Customer Authentication under the Payment Services Regulations 2017). UFR retains only a tokenised reference so we can reconcile and, where necessary, refund your payment.

We never sell your personal data. We only share it with:

• Payment providers — to process transactions and refunds.
• Email service providers — to send transactional emails (entry confirmations, winner notifications) and, where you opt in, marketing.
• Analytics providers — aggregated, where enabled, to understand site usage.
• Delivery partners — the name and address of winners, solely to dispatch prizes.
• Authorities — where required by law, regulation or a valid court order.

Some of our service providers may process data outside the UK/EEA. Where they do, we ensure an adequate level of protection through UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or Standard Contractual Clauses with additional safeguards.

We keep account and entry data for as long as your account is active and for a reasonable period afterwards. Transaction and financial records are retained for at least 6 years to meet UK tax and accounting obligations. When data is no longer needed, it is securely deleted or anonymised.

We use essential cookies to keep you logged in and to secure your session. With your consent, we may also use analytics cookies to measure traffic and improve the site. You can manage or block cookies through your browser settings; blocking essential cookies may affect how the site works.

You have the right to:

• Be informed about how your data is used (this policy);
• Access a copy of the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Request erasure ("right to be forgotten"), subject to our legal retention duties;
• Restrict or object to processing, including opting out of marketing at any time;
• Data portability — receive your data in a structured, machine-readable format;
• Withdraw consent where processing is based on consent.

To exercise any of these rights, email Support@ultimatefootballraffles.com. We will respond within one month.

We protect your data with encryption in transit (TLS), hashed passwords, access controls and regular security reviews. No system is completely secure, but we take reasonable technical and organisational measures to safeguard your information, and we will notify you and the ICO of any breach where legally required.

UFR is strictly for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If we learn that we have, we will delete it promptly.

If you have concerns about how we handle your data, please contact us first at Support@ultimatefootballraffles.com. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

We may update this Privacy Policy from time to time. The "last updated" date at the top reflects the latest version. Material changes will be notified by email to registered users where reasonably practical.