Privacy Policy

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller is [Company Name Limited] (Company Number: [Company Number]), England and Wales.

Registered office: [Registered Office Address, United Kingdom].
Correspondence address: [Correspondence Address, United Kingdom].
Data Protection & Privacy inquiries: support@treatstreet-giveaways.com

We collect and process the following categories of personal data when you interact with Treat Street:

• Account & Identity: Email address, your password (stored securely in cryptographic hashed form), and an internal account ID.
• Profile Information: Public username, date of birth (collected strictly to verify you are 18 or over), and date and time of registration.
• Draw & Entry Records: Records of draws you have entered, dates and times of entry, and daily check-in activity.
• Winner & Fulfilment Data: Winning records, claim timestamps, Tremendous order identifiers, and claim delivery email address.
• Communication Preferences: Your explicit consent choices for optional draw announcements and closing reminders.
• Technical & Network Metadata: Device details, browser user agent, coarse operational logs, and coarse location data (country-level only), checked automatically when you enter to verify UK eligibility and discarded immediately after verification.

Under UK GDPR Article 6, we rely on the following lawful bases to process your personal data:

We do not sell, rent, or trade your personal data. We share only necessary information with trusted service providers acting under strict Data Processing Agreements:

• Supabase Inc.: Cloud database and authentication infrastructure, situated within the European Union (Ireland).
• Vercel Inc.: Cloud website hosting, content delivery, and traffic routing. Vercel provides request routing, operational logging, and Speed Insights anonymous performance metrics.
• Resend Inc.: Transactional email service provider used to send authentication messages, mandatory winner notices, and consented draw announcements.
• Tremendous Inc.: Licensed reward and payout processor. When you claim a prize, your email and winner order ID are transmitted to Tremendous to issue your gift voucher.
• Google LLC (Google Ad Manager): Where advertising is enabled, Google serves non-personalized or limited adverts. We do not transmit account credentials, names, or draw entries to Google.

Where personal data is transferred outside the United Kingdom or European Economic Area (such as to US-based subprocessors including Vercel, Resend, or Tremendous), transfers are secured through standard contractual clauses (SCCs), the UK International Data Transfer Addendum, or relevant adequacy regulations to ensure your data receives equivalent protection under UK law.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, or protect legitimate interests:

• Active Accounts: Retained while active. Inactive accounts with no recorded activity for seven (7) consecutive years are automatically purged by automated routine deletion processes.
• Optional Email Preferences: Automatically deactivated after six (6) months of inactivity.
• Active Entries: Closed after each draw concludes or permanently removed if you delete your account.
• Account Deletion & Retained Historical Evidence: When you delete your account, your profile, personal credentials, and active entries are immediately and permanently removed. However, to maintain promotional transparency, prevent fraud, and comply with CAP Code proof-of-award rules, completed draw results, anonymised winner outcomes (re-labeled as an unlinked deleted user or anonymous winner), and past reward fulfillment audit records are retained and cannot be completely erased.

Treat Street uses an automated random selection process to pick winning entries from the pool of confirmed, eligible entries at the moment the draw closes.

This automated process is purely statistical and does not involve profiling, behavioral analysis, credit scoring, or individual assessment. Each entrant has an equal mathematical probability per held entry.

Under UK data protection laws, you possess the following rights regarding your personal information:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete information.
• Right to Erasure: Request deletion of your account and personal data (subject to legitimate retention of promotional audit evidence).
• Right to Restriction: Request limitation of processing under specific circumstances.
• Right to Object: Object to processing based on legitimate interests, including objecting to public username display following a win.
• Right to Data Portability: Receive your data in a structured, commonly used machine-readable format.
• Right to Withdraw Consent: Withdraw consent for optional draw emails at any time via your profile settings.

To exercise any of these rights, please email us at support@treatstreet-giveaways.com. We verify requester identity before disclosing or altering personal data.

Treat Street uses strictly necessary session cookies to maintain secure authentication and account access.

Treat Street operates exclusively with limited, non-personalized adverts at launch. We do not use personalized behavioral advertising, tracking cookies, or profiling across the web. All adverts are served using Google's Limited Ads mode, which operates without storing or reading advertising cookies on your device.

If you have questions or concerns regarding our privacy practices, please reach out to us at support@treatstreet-giveaways.com.

You also have the right to lodge a complaint with the UK supervisory authority for data protection, the Information Commissioner's Office (ICO):

Website: https://ico.org.uk/make-a-complaint/
Helpline: 0303 123 1113