TOMBOLIZE LTD
PRIVACY POLICY

Last updated: April 2026 | Version 1.0

At Tombolize, we are fully committed to protecting the privacy and security of our customers and website visitors. We understand the trust you place in us when you provide personal data, and we take that responsibility seriously. This Privacy Policy explains how Tombolize LTD collects, uses, and protects your personal information in connection with our online skill-based quiz and prize competition platform at tombolize.com.

We do not share your data with third parties for their own marketing purposes. If you have any questions, please contact us at: [email protected].

1. ABOUT US

Tombolize LTD (‘Tombolize’, ‘we’, ‘us’, ‘our’) is a company registered in England and Wales under company number 16855914, with registered office at 61 Bridge Street, Kington, United Kingdom, HR5 3DJ. We operate an online skill-based prize competition platform accessible at www.tombolize.com (the ‘Website’) and via our mobile applications.

Tombolize LTD is the data controller responsible for the personal data we collect and use as described in this Policy. We are registered with the Information Commissioner’s Office (ICO) in the United Kingdom.

2. WHAT THIS POLICY COVERS

This Privacy Policy tells you:

• What types of personal data we collect from you and how we collect it;
• How and why we use your personal data, and the lawful basis for doing so;
• With whom we share your personal data;
• How long we retain your data;
• Your rights in relation to your personal data and how to exercise them;
• How to contact us if you have questions or concerns.

3. WHAT INFORMATION DO WE COLLECT?

We may collect and process the following categories of personal data:

3.1 Information you provide directly

• Identity data: your first name, surname, date of birth, username and password.
• Contact data: email address, telephone number, and postal address.
• Financial data: payment card details, billing address, and transaction history.
• Account data: your competition preferences, account settings, and history of competitions entered.
• Communications data: the content of messages you send us, including queries, feedback, and complaints.
• Verification data: copies of identity documents where required to verify your age or eligibility.
• Surprise data: if a friend or family member provides your contact details to arrange a prize surprise on your behalf.

3.2 Information we collect automatically

When you visit our Website or use our app, we may automatically collect:

• Technical data: IP address, browser type and version, operating system, device identifiers.
• Usage data: pages viewed, time spent on page, links clicked, entry history, error logs.
• Location data: approximate location derived from your IP address, where relevant to verify eligibility.
• Cookie data: see our Cookie Policy at www.tombolize.com/cookies for full details.

3.3 Information from third parties

If you choose to register or log in using a third-party social media account (such as Google, Apple, or Facebook), we will receive certain information from that platform, including your name and email address, as permitted by your privacy settings on that platform.

4. HOW AND WHY WE USE YOUR PERSONAL DATA

We only process your personal data when we have a lawful basis to do so under UK data protection law (UK GDPR and the Data Protection Act 2018). The table below sets out the purposes for which we use your data and our lawful basis:

5. WHO DO WE SHARE YOUR DATA WITH?

We do not sell your personal data. We do not share your data with third parties for them to market their products or services to you.

We may share your personal data with the following categories of third parties, strictly to deliver our services:

• Payment processors and banking partners, to process ticket purchases and prize payments;
• Identity verification providers, to confirm eligibility and prevent fraud;
• IT and cloud hosting providers, who host and maintain our platform infrastructure;
• Independent judges and legal advisors, who oversee the fairness and legal compliance of our competitions;
• Competition auditors and verification services (such as PromoVeritas or equivalent), to certify draw processes;
• Marketing and analytics service providers, where you have consented to marketing;
• Regulatory authorities and law enforcement agencies, where we are required by law to do so;
• Professional advisors, including solicitors, accountants, and compliance consultants;
• A prospective purchaser or investor in the event of a sale or restructuring of our business.

All third parties with whom we share data are required to handle it in accordance with applicable data protection law and are bound by appropriate confidentiality and data processing agreements.

6. INTERNATIONAL DATA TRANSFERS

We are a UK-registered company and our primary data processing takes place within the United Kingdom and the European Economic Area (EEA). Where it is necessary to transfer your personal data outside the UK or EEA (for example, to use a service provider based in another country), we will ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the ICO or the European Commission, or that the transfer is to a country deemed to provide an adequate level of protection.

You may contact us for more information about the safeguards we apply to international data transfers.

7. HOW WE KEEP YOUR DATA SECURE

We implement industry-standard technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction. These measures include encryption of data in transit (SSL/TLS), access controls, secure data storage, and regular security reviews.

Please be aware that no method of transmission over the internet is entirely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security of data transmitted to us electronically. Any transmission is made at your own risk.

We ensure that all third-party service providers who handle personal data on our behalf maintain appropriate security standards.

8. HOW LONG DO WE KEEP YOUR DATA?

We will retain your personal data for as long as your Tombolize account is active or as long as we have a legitimate need to keep it, including to fulfil our legal, regulatory, accounting, or reporting obligations.

In particular:

• Account data is retained for the duration of your account and for up to 7 years after account closure, to comply with financial and legal obligations;
• Competition entry data and prize records are retained for up to 7 years after the relevant competition, for audit and legal purposes;
• Marketing preferences and consent records are retained until you withdraw consent, plus a reasonable period thereafter as evidence of that consent;
• Technical and usage data collected via cookies is retained in accordance with our Cookie Policy.

Accounts with no login activity for 12 consecutive months will be considered inactive. We may send service notifications regarding account status. After a further 12 months of inactivity, the account will be placed in archived status.

9. YOUR RIGHTS

Under UK data protection law, you have the following rights in relation to your personal data. Please note that these rights are not absolute and may be subject to certain conditions or exemptions.

• Right of access: You may request a copy of the personal data we hold about you (a Subject Access Request).
• Right to rectification: You may ask us to correct any inaccurate or incomplete data we hold about you.
• Right to erasure: In certain circumstances, you may ask us to delete your personal data (‘the right to be forgotten’).
• Right to restrict processing: You may ask us to pause the processing of your data in certain circumstances.
• Right to data portability: You may request that we transfer your data to you or another provider in a structured, machine-readable format.
• Right to object: You may object to our processing of your data where we rely on legitimate interests, including direct marketing.
• Right to withdraw consent: Where we process your data based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Rights related to automated decision-making: We do not make solely automated decisions that significantly affect you, but if we did, you would have the right to human review.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk.

10. COOKIES

We use cookies and similar tracking technologies on our Website and app. For full details of the cookies we use, why we use them, and how to manage your preferences, please see our Cookie Policy at www.tombolize.com/cookies.

11. MARKETING COMMUNICATIONS

We may send you marketing communications about Tombolize competitions, offers, and services where you have consented to receive them, or where we have a legitimate interest to do so (for example, if you are an existing customer).

You can opt out of marketing communications at any time by clicking the ‘unsubscribe’ link in any marketing email, by updating your preferences in your Tombolize account, or by contacting us at [email protected]. Please note that we may still need to send you essential service-related communications even if you opt out of marketing.

12. CHILDREN’S PRIVACY

Our services are strictly for persons aged 18 years and over. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly. If you believe we may have collected data from a person under 18, please contact us immediately at [email protected].

13. LINKS TO THIRD-PARTY WEBSITES

Our Website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to read the privacy policies of any external sites you visit.

14. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will publish the updated version on our Website and, where the changes are material, we will notify you by email or via a prominent notice on our Website. Your continued use of our services after any update constitutes acceptance of the revised Policy.

15. CONTACT US

If you have any questions about this Privacy Policy or how we handle your personal data, or to exercise your rights, please contact us:

• Email: [email protected]
• Website: www.tombolize.com
• Post: Tombolize LTD, 61 Bridge Street, Kington, United Kingdom, HR5 3DJ

---

Tombolize LTD | Company No. 16855914 | Registered in England and Wales | www.tombolize.com