Privacy notice
Last updated 6 Nov 2026
This notice explains how TufLuck Ltd uses personal data when you tap a TufLuck tag, enter a competition, create an account or visit a page on game.tufluck.co.uk. We've kept it as plain as we can.
Who we are
TufLuck Ltd is the data controller. Address: [add company address in lib/config.php]. Email: info@atua.co.uk.
What we collect
- Your email address, the code of the tag you tapped, and when you entered or signed up.
- Your consents: the exact wording you agreed to and when (competition terms, and marketing if you choose it).
- Your account: a securely hashed password (we can't read it), your tag settings and the page you build, including any images or files you upload.
- Security data: a one-way hash of your IP address with your entry (to spot fraud), and short-lived rate-limit records (deleted within 24 hours).
- If you win: the name, delivery address and phone number you send us to get your prize to you.
- Page statistics: when someone views a page here we count it without cookies. We store the device type, the referring site, the country (where our network provides it) and a visitor ID that is a one-way hash which changes every day — we don't store IP addresses for this.
Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Running the competition: recording your entry, checking eligibility, picking and contacting the winner, delivering the prize | Contract — taking part under the competition terms |
| Your account and tag: confirming your email, signing you in, saving your tag settings and page, password resets | Contract — providing the service you asked for |
| Stopping fraud, abuse and duplicate entries; keeping the service secure; page statistics | Legitimate interests — running a fair competition and a secure service |
| Marketing emails about our products and offers | Consent — only if you tick the optional box. Withdraw it any time. |
| Keeping records we're legally required to keep, and responding to legal requests | Legal obligation |
You don't have to give us your email, but without it we can't enter you into a competition or give you an account. The winner is picked at random by computer; no other automated decisions are made about you.
Marketing
Entering a competition never signs you up to marketing. We only email you news and offers if you ticked the separate marketing box and confirmed your email. You can unsubscribe in your account, through the link in any marketing email, or by emailing us. Account and competition emails (like confirmations and winner notices) are still sent because they're part of the service.
Who we share it with
We never sell your data. We share it only with:
- our website host and email delivery provider, who process it for us under contract ([name your host and email provider]);
- a courier, if you win and we post you the prize;
- if you opted in to marketing, our email marketing provider ([e.g. Mailchimp/Klaviyo, or remove this line]);
- authorities, if the law requires it.
If any provider stores data outside the UK, we make sure it is protected by UK adequacy regulations or the ICO's International Data Transfer Agreement/Addendum.
Pages built by members
Members can publish their own TufLuck Tag page on this site. The member is responsible for what they publish. These pages don't use tracking or advertising cookies, and can't collect visitors' details through forms. Report a page that breaks the rules to info@atua.co.uk.
How long we keep it
- Sign-ups never confirmed: deleted after 30 days.
- Competition entries: anonymised 12 months after the competition closes. Winner prize-delivery details are deleted once the prize is delivered and any dispute period has passed.
- Your account and page: until you delete them. You can do this yourself at any time from your account.
- Marketing consent records: as long as you're subscribed, plus up to 2 years afterwards as proof of consent.
- Page statistics: up to 400 days. Admin activity log: 2 years.
Your rights
You have the right to: access your data and get a copy; have it corrected; have it deleted; restrict or object to how we use it; take it to another service (portability); and withdraw consent at any time. Many of these are one click in your account (download my data, delete my account, marketing preferences). For anything else, email info@atua.co.uk — we'll reply within one month.
If you're unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.
Cookies
The competition, account and member pages only use one cookie, lib_admin, which keeps you signed in. It's strictly necessary, so it doesn't need consent, and it's deleted when you close your browser. Our own brand page may use Google Analytics or a Meta Pixel, but only if you click “Accept” on its cookie banner.
Age
Competitions are for people aged 18 or over unless the terms say otherwise. Accounts are for people aged 16 or over.
Changes
If we change this notice in a way that matters, we'll update the date at the top and, where appropriate, tell account holders by email.