1. Introduction
VALTORIX LTD ("Valtorix", "we", "us", "our") is a company registered in England and Wales (Companies House #16946555), with registered office at 27 Longbridge Road, Barking, Essex, IG11 8TN, United Kingdom. We operate the website valtorixcompetitions.com (the "Site") and the prize competitions offered through it.
This Privacy Policy explains how we collect, use, store and share your personal data when you use the Site or participate in our competitions. It is issued in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
Data Controller: VALTORIX LTD, 27 Longbridge Road, Barking, Essex, IG11 8TN. Contact: [email protected].
2. Personal Data We Collect
- Account data: first name, last name, email, password (hashed), date of birth, country, mobile phone (optional).
- Identity verification (KYC): when you win a prize or on a risk-based check, we may collect a copy of your government-issued ID and proof of address.
- Transaction data: entries purchased, payment method type (we do NOT store card numbers — these are handled by our PCI-DSS compliant payment processor), transaction reference, amount, currency, date.
- Skill question data: the answer you provide to the qualifying skill question, IP address, timestamp (held as legal audit trail under the Gambling Act 2005 s.14).
- Free postal entry data: name, address, competition reference (only when you enter via the free postal route described in our Terms).
- Technical data: IP address, browser type, device, operating system, pages visited, referring URL.
- Communication data: emails or messages you send to support, customer service notes.
3. How We Use Your Data (Lawful Bases)
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Operating your account, accepting entries, running draws, paying prizes | Performance of contract (Art. 6(1)(b)) |
| Skill question audit log, free postal entry register | Legal obligation (Art. 6(1)(c)) — Gambling Act 2005 |
| Fraud prevention, KYC, AML checks | Legal obligation + legitimate interests (Art. 6(1)(c) and (f)) |
| Customer support, complaints handling | Performance of contract / legitimate interests |
| Service announcements (e.g. draw results) | Performance of contract |
| Marketing emails about new competitions | Consent (Art. 6(1)(a)) — opt-in only, withdrawable any time |
| Site analytics (anonymised where possible) | Consent or legitimate interests |
| Tax, accounting and regulatory record-keeping | Legal obligation (HMRC, Companies Act) |
4. Cookies
We use cookies for: (a) strictly necessary functions (session, login, CSRF — no consent required under PECR); (b) functional cookies (language, preferences — consent); (c) analytics cookies (consent). You can manage cookies through our cookie banner or your browser settings. Refusing non-essential cookies will not block your ability to participate in competitions.
5. Sharing Your Data
We share personal data only with:
- Payment processors (Cashflows, G2Pay or equivalent FCA-regulated processor) — to process your transactions. They act as independent controllers for the card data they collect directly.
- Hosting provider (Hostinger International Ltd) — as data processor.
- Email/SMS provider — for transactional and (with consent) marketing communications.
- KYC/AML provider — when identity verification is required.
- Professional advisers (accountants, solicitors) — under confidentiality.
- Authorities (HMRC, ICO, police, courts) — where required by law.
We do NOT sell your personal data and we do NOT share it with third-party advertisers.
6. International Transfers
Some of our processors may be located outside the UK/EEA. Where this is the case, transfers are protected by adequacy decisions or by Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, supplemented by additional safeguards as required.
7. How Long We Keep Your Data
| Data category | Retention period |
|---|---|
| Account data (active account) | For the duration of your account + 6 years after closure (HMRC requirement) |
| Transaction records | 6 years from transaction (HMRC, Companies Act 2006) |
| Skill question audit log | 6 years from entry |
| Free postal entry register | 6 years from competition draw date |
| KYC documents | 5 years from end of business relationship (Money Laundering Regulations 2017) |
| Marketing consent records | Until you withdraw consent + 2 years for proof |
| Server logs | 90 days (rolling) |
8. Your Rights Under UK GDPR
You have the right to: (a) access your data; (b) correct inaccurate data; (c) erase your data ("right to be forgotten" — subject to legal retention obligations above); (d) restrict processing; (e) data portability; (f) object to processing based on legitimate interests or for marketing; (g) withdraw consent at any time; (h) not be subject to solely automated decisions with legal effect; (i) lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.
To exercise any right, email [email protected]. We respond within 30 days (extendable to 90 days for complex requests, with notice).
9. Security
We use HTTPS/TLS encryption, hashed passwords (bcrypt), CSRF protection, rate limiting, and host on infrastructure with ISO 27001 certified providers. Card data is never stored on our servers — it is tokenised by our PCI-DSS Level 1 payment processor. Despite our controls, no online system is 100% secure; you remain responsible for keeping your password confidential.
10. Children
Our services are strictly for persons aged 18 or over. We do not knowingly collect data from anyone under 18. If we learn that an underage person has registered, we will close the account, refund any entry fees and delete the data immediately.
11. Marketing & Withdrawal of Consent
If you opted in to marketing emails, you can unsubscribe at any time using the link at the bottom of every marketing email, or by emailing [email protected]. Transactional emails (e.g. draw results, winner notifications) cannot be opted out while your account is active, as they are required for the service.
12. Self-Exclusion & Responsible Gambling
If you wish to self-exclude from our competitions, email [email protected] requesting self-exclusion. We will close the account and prevent re-registration with the same identifiers for the period you request (minimum 6 months). For gambling support, see BeGambleAware.org or call the National Gambling Helpline on 0808 8020 133.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified by email and/or by a notice on the Site at least 14 days before they take effect. The "last updated" date at the bottom indicates the current version.
14. Contact & Complaints
Questions, requests or complaints: [email protected] or write to VALTORIX LTD, 27 Longbridge Road, Barking, Essex, IG11 8TN, United Kingdom.
If you are not satisfied with our response, you have the right to complain to the ICO (Information Commissioner's Office), Wycliffe House, Water Lane, Wilmslow, SK9 5AF — ico.org.uk — 0303 123 1113.
Last updated: 8 May 2026. Version 1.0 — pending solicitor review.