Privacy notice

This notice describes the account service and draw-entry information. Creating an account alone does not enter a draw. Our retention criteria are set out below. Provider processing can take place outside the UK.

Who is responsible

Michael Ashurst trading as Big Smile Draws. Contact hello@bigsmiledraws.co.uk or write to 4 Arthur St, Newton Stewart, DG8 6DE.

Account information

The account service uses your email, password authentication, verification status and session records. Supabase handles passwords; the registration Worker does not save your password. A secure, HttpOnly session cookie normally lasts one hour. Verification and recovery emails do not subscribe you to marketing.

Draw information

The separate entry form collects name, verified email, UK mobile number, date of birth, postcode and eligibility and rules confirmations. Records include the entry reference, acceptance time, rules version, separate optional marketing choices and receipt-delivery attempts. Verified winner records may include eligibility, contact and payment evidence.

This information administers accounts and entries, checks eligibility, prevents duplicates and abuse, contacts the winner, delivers the prize and records fair administration. Required entry details are necessary to participate. Marketing is optional.

Reasons for using information

Account and draw administration support the service requested by the entrant. Security, fraud prevention and proportionate dispute records support our legitimate interests in running a fair, secure service. Promotional emails require separate consent. Consent withdrawal does not affect an accepted entry. Legally required records are kept to meet the relevant obligation.

Providers and technical information

Cloudflare hosts registration and supplies Turnstile bot protection. Supabase supplies authentication and the entry database; the current project is in its London region. Resend handles transactional emails. Providers process technical information for security and delivery. A London database region does not mean every provider operation stays in the UK. Resend may store email content and delivery logs in the United States. Provider contractual safeguards apply to international processing, including applicable standard contractual clauses and UK transfer provisions. Contact us for information about relevant safeguards.

The registration service uses a keyed, one-way network-address fingerprint for request-rate limiting. Its draw-entry record does not include the raw network address. Providers may keep their own operational logs. Entrant records and private credentials are not published.

Retention and deletion

We review retained personal information monthly and remove or anonymise it when its recorded purpose ends. Reviews and deletion are managed manually.

• Pilot records: reviewed when testing ends and removed when no longer needed for testing or an unresolved support issue.
• Account information: kept while providing your requested account service. An account-closure request triggers a review; information needed separately for an accepted draw, complaint or legal obligation is assessed independently.
• Draw entries, receipts and contact or eligibility information: reviewed once the prize is paid and complaints are resolved. Information is removed or anonymised when the documented administration or dispute purpose ends. We do not keep unused birth dates or contact details indefinitely.
• Selection, winner and payment evidence: only the minimum information needed to demonstrate fair administration, payment or an identified accounting or dispute obligation is retained. Any longer hold must have a recorded reason and review date; its duration depends on the applicable obligation or unresolved issue.
• Marketing: consent evidence is kept while necessary to demonstrate permission. After an opt-out we may retain minimal suppression information to avoid contacting you again.
• Security rate limits: request-limit buckets older than one day are removed during subsequent rate-limit checks. Provider security and delivery logs follow the provider’s applicable retention arrangements.

Deletion requests are reviewed even before the next scheduled review. Necessary retained records are restricted to their remaining purpose. Backups may contain earlier copies until their retention cycle expires; if restored, recorded deletion requests must be reapplied before normal use. Email hello@bigsmiledraws.co.uk to request closure or deletion.

Marketing and award information

Marketing is separate and optional. Withdraw consent by emailing hello@bigsmiledraws.co.uk. Future marketing emails must also include an unsubscribe method; a minimal suppression record may be required to honour an opt-out.

Evidence of a valid award ordinarily includes the winner’s surname and county. You can object or request reduced disclosure. Evidence may still be supplied to the Advertising Standards Authority if challenged. Other entrants’ contact details will not be published as an entry list.

Your rights

Depending on the circumstances, request access, correction, deletion, restriction or portability. You may withdraw consent at any time.

Right to object: you can object to processing based on legitimate interests and to direct marketing. Email hello@bigsmiledraws.co.uk. We may require proportionate identity verification; some records may need to be retained for a lawful reason.

You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.

Updated 8 October 2026.