Privacy Policy

CCV Group Ltd ("we", "us", "our") is a company registered in Scotland. We operate the website ccvgroupltd.co.uk and are the data controller for all personal data collected through this website and our associated services.

Our registered address is Unit 16 Midfield Drive, Kirkcaldy, Fife, KY1 3LW, Scotland.

If you have any questions about how we handle your personal data, please contact us at [email protected].

We may collect the following categories of personal data when you use our website:

• •Name and email address — when you submit our contact form, place an order, or enter a prize draw
• •Date of birth — for prize draw eligibility verification (you must be 18 or over)
• •Postal address — for order delivery, prize dispatch, and free postal entry processing
• •Phone number — if provided voluntarily via the contact form
• •Order and payment information — transaction details processed via our payment provider (we do not store full card details; payment data is handled by Stripe)
• •Prize draw entry data — entry details, ticket or entry numbers, draw results, and entry method (paid or free postal)
• •Free postal entry data — name, address, date of birth and other details included in a postal entry envelope
• •Winner identity and verification data — where required to confirm eligibility before releasing a prize
• •Message content — when you contact us via email or the contact form
• •Mailing list subscription data — if you opt in to marketing communications
• •IP address and browser information — collected automatically via server logs
• •Cookies and usage data — see our Cookie Policy for details
• •Google Analytics data — anonymised usage data collected via Google Analytics 4 where you have consented

Running prize draw competitions requires us to collect and process specific categories of personal data. This section explains that processing in detail.

We use your personal data for the following purposes:

• •To respond to enquiries and messages you send us
• •To process and fulfil ecommerce orders, including payment processing and delivery
• •To administer prize draw entries — both paid and free postal
• •To conduct prize draws and select winners
• •To verify winner identity, age and eligibility before releasing prizes
• •To announce winners (using first name and initial only unless you consent otherwise)
• •To send order confirmations, dispatch notifications and prize draw updates
• •To send milestone emails to competition entrants (see Section 3)
• •To send marketing communications where you have opted in
• •To prevent fraud and ensure the security of our website and transactions
• •To comply with legal and regulatory obligations, including the Gambling Act 2005
• •To improve our website and services using anonymised analytics data

We will only use your data for the purpose for which it was collected. We will not use your data for automated decision-making or profiling.

Under UK GDPR, we process your personal data on the following legal bases:

We use the following third-party data processors to operate our website and services. Each processor is bound by a data processing agreement and is required to handle your data securely and only for the purposes we specify.

We may update this list as our service providers change. Material changes will be reflected in an updated version of this policy.

We do not sell, rent or trade your personal data to third parties.

Beyond the processors listed in Section 6, we may share your data in the following limited circumstances:

• •With law enforcement or regulatory authorities where required by law or court order.
• •To protect our legal rights or to prevent fraud or illegal activity.
• •With professional advisers (solicitors, accountants) where necessary, subject to confidentiality obligations.
• •In the event of a business sale or transfer, with the acquiring entity — you will be notified in advance.

We do not transfer your personal data outside the UK or EEA except where a processor operates internationally (e.g. Google Analytics, Stripe). Where such transfers occur, they are subject to appropriate safeguards under UK GDPR.

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law:

• •Contact form submissions: up to 2 years from the date of submission
• •Ecommerce order data: 7 years in accordance with HMRC requirements
• •Prize draw entry data: 12 months following the close of the draw
• •Free postal entry envelopes: destroyed securely after the draw and any dispute period
• •Winner verification data: 12 months following prize dispatch
• •Marketing subscription data: until you unsubscribe or withdraw consent
• •Analytics data: subject to Google Analytics retention settings (default 14 months)
• •Server logs (IP address, browser data): up to 90 days

You may request deletion of your data at any time (see Section 9), subject to any legal retention obligations that prevent earlier deletion.

Under UK GDPR and the Data Protection Act 2018, you have the following rights regarding your personal data. These rights are not absolute and may be subject to exemptions in certain circumstances.

To exercise any of these rights, please contact us at [email protected] with the subject line: Data Protection Request — [your name]. We will respond within one calendar month. We may ask you to verify your identity before processing your request.

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) — the UK's independent data protection regulator.

We would, however, appreciate the opportunity to address your concerns before you contact the ICO. Please raise any data protection complaint with us first using our Complaints Procedure.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or destruction. These measures include:

• •HTTPS encryption for all data transmitted to and from this website
• •Secure server infrastructure provided by our hosting provider
• •Access controls limiting who within CCV Group Ltd can access personal data
• •Use of reputable third-party processors with their own security certifications (e.g. Stripe is PCI DSS compliant)

While we take reasonable precautions, no internet transmission or storage system is completely secure. If you believe your data has been compromised, please contact us immediately at [email protected].

Our website uses cookies and similar tracking technologies. For full details of the cookies we use, their purpose, and how to manage your preferences, please see our Cookie Policy.

Analytics cookies (Google Analytics 4) are only activated where you have given consent via our cookie banner. You may withdraw consent at any time by adjusting your cookie preferences.

CCV Group Ltd is committed to responsible participation in our competitions. We currently handle responsible play requests manually by email. Where you contact us to request a cooling-off period or self-exclusion, we will process the following data:

• •Your email address (used to identify your request)
• •The type of request made and the date it was received
• •Any changes or removals of restrictions, including the date
• •A suppression flag to prevent marketing communications during a cooling-off or exclusion period

This data is processed on the basis of legitimate interests in preventing harm and honouring your request. It is retained for a minimum of 5 years to support dispute resolution.

A self-service account controls system (spending limits, cooling-off, suspension) is planned for a future release. This section will be updated when those controls are implemented. Responsible play data is not used for any purpose other than enforcing the restrictions you have requested and suppressing marketing where appropriate.

Our website and services are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18.

If you believe we have inadvertently collected data from a person under 18, please contact us immediately at [email protected] and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, services or legal obligations. The date at the top of this page indicates when it was last revised.

Where changes are material, we will take reasonable steps to notify you — for example, by displaying a notice on our website or emailing you where we hold your contact details. We encourage you to review this policy periodically.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

For data protection complaints, please also refer to our Complaints Procedure.