Privacy Policy

This Privacy Policy explains what personal data Revwyn collects, why, the lawful bases we rely on, who we share it with, how long we keep it, and the rights you have. We only collect what we need to run your account and our competitions.

1. Who is responsible for your data

Revwyn (operated by Revwyn Ltd, company number 17356739, registered office Flat 1, 16 Churchgate Street, Soham, Ely, CB7 5DS, England) is the "controller" of your personal data. For any privacy question, or to exercise your rights, contact us at [email protected]. We are registered with the Information Commissioner's Office (ICO) under registration number ZC226015.

2. The data we collect

• Account details: your name, email address, date of birth (to confirm you are 18+), password (stored only in a securely hashed form), and country of residence.
• Entry and competition activity: the competitions you enter, whether by paying or by the free route, your skill-question attempts, your ticket numbers, and any prizes.
• Payment information: we do not store your full card details — these are handled by our regulated payment provider. We keep a record of your transactions (amounts, dates, order references).
• Identity and verification data (winners and withdrawals only): when you win or withdraw, we collect the identity documents and information needed for age, identity and anti-money-laundering checks.
• Communications and preferences: messages you send us, your marketing choices, and the record of which version of our terms and this policy you accepted, and when.
• Technical and usage data: device, browser and log information, and (where you consent) analytics about how you use the site.

3. How and why we use your data, and our lawful basis

We state a specific lawful basis for each purpose (UK-GDPR Article 6):

• Creating and running your account — basis: contract.
• Processing your entries, skill answers and ticket allocations, and running the draw — basis: contract.
• Taking payment for entries — basis: contract.
• Verifying age, identity and carrying out anti-money-laundering, sanctions and related checks on winners and withdrawals — basis: legal obligation.
• Preventing fraud, abuse and misuse, and keeping the platform secure — basis: legitimate interests (our interest in protecting the platform, our customers and the fairness of every draw).
• Sending you marketing — basis: consent (see section 4). We never rely on any other basis for marketing.
• Analytics and improving the service — basis: consent for non-essential cookies, and legitimate interests for the resulting analysis.
• Complying with our legal and regulatory obligations and handling disputes — basis: legal obligation and legitimate interests.

4. Marketing and your choices

We will only send you marketing emails or texts if you have separately and specifically opted in. Marketing consent is never bundled with entering a competition and is never a condition of entry. Every marketing message identifies us and includes a working unsubscribe link, and you can withdraw consent at any time from your account or by unsubscribing — withdrawing has no effect on your entries or your account. This reflects the Privacy and Electronic Communications Regulations (PECR) and UK-GDPR.

5. Who we share your data with

We share personal data only with service providers who process it on our behalf under a written data-processing agreement, and with authorities where the law requires. Our categories of recipient are:

• Hosting and infrastructure: our cloud database and authentication provider, application hosting, content-delivery/security, and caching providers (currently Supabase, Railway, Vercel, Cloudflare and Upstash).
• Payment processing: our regulated payment provider (an FCA-authorised card acquirer and, where offered, an open-banking payment provider). Card details are entered directly with that provider and never reach our servers.
• Identity and anti-money-laundering checks: our identity-verification provider (winners and withdrawals only).
• Communications: our email and SMS providers (currently Resend for email).
• Analytics: our privacy-focused analytics provider, where you consent.
• Professional advisers, regulators and authorities where we are legally required or permitted to share.

We do not sell your personal data.

6. Sending data outside the UK

Some of our providers process data outside the United Kingdom. Where they do, we make sure the transfer is protected — either the country has UK "adequacy" status, or we rely on approved safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguards in place for any specific transfer.

7. How long we keep your data

We keep personal data only for as long as we need it:

• Account data — for as long as your account is open, and for a reasonable period afterwards.
• Financial, entry, draw and audit records — retained on an append-only basis for 6 years from the end of the relevant financial year, to meet our legal, tax, accounting and anti-money-laundering obligations and to prove that draws were fair.
• Identity/AML verification records — for the period required by anti-money-laundering law (5 years after the relationship ends).
• Marketing data — until you withdraw consent, after which we keep only a minimal suppression record so we do not contact you again.
• Unsuccessful verification documents and transient technical data — deleted when no longer needed.

8. Automated decisions

To keep the platform safe we use automated checks — for example, fraud and payment-risk screening, and pass/fail identity or anti-money-laundering checks — that can decline a payment, hold a withdrawal, or restrict an account. Where a decision that significantly affects you is made solely by automated means, you have the right to ask for a person to review it. Contact us using the details in section 1 to request a human review or to challenge such a decision.

9. Your rights

You have the right to: access the personal data we hold about you; have inaccurate data corrected; have data erased in certain circumstances; restrict or object to certain processing; receive your data in a portable form; and, where we rely on consent, withdraw it at any time. To exercise any of these, contact us using the details in section 1. We respond without undue delay and within one month. Exercising your rights is free in most cases. Note that some data (such as financial and anti-money-laundering records) we are legally required to keep even if you ask us to erase it.

10. Cookies and similar technologies

We use cookies that are strictly necessary to run the site and to keep your session secure. We only set non-essential cookies (for example, analytics) with your consent, which you can give or withdraw at any time through our cookie controls. We do not use cookies for advertising or cross-site tracking.

11. Keeping your data secure

We protect your data with encryption in transit and at rest, strict access controls, and tamper-evident audit trails. We never expose or unnecessarily log sensitive personal or payment data. If a personal-data breach occurs that is likely to risk your rights, we will notify the ICO within 72 hours where required, and you where the law requires.

12. Children

Revwyn is strictly for adults. You must be 18 or over to use it, and we verify age. We do not knowingly collect data from anyone under 18; if you believe a minor has used the platform, contact us and we will act.

13. Complaints

If you are unhappy with how we handle your data, please tell us first using the details in section 1 so we can put it right. You also have the right to complain to the ICO at ico.org.uk, by calling 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

14. Changes to this policy

We keep this policy under a clear version number and effective date and record which version applied over time. We will tell you about significant changes. The current version always applies.

18+ · United Kingdom only.