1in100 – Privacy Policy

Last updated:

1. Who We Are
1in100 is operated by Cardowl Limited.
2. What Personal Data We Collect
Name, email address, mobile number, postal address, order and prize draw data,
communication preferences, IP/device data.
3. How We Use Your Data
To process orders, administer prize draws, notify winners, prevent fraud, provide support.
With consent: marketing emails, SMS, push notifications, and charity-related updates.
4. Marketing Communications
Marketing is optional and opt-in only. Consent can be withdrawn at any time.
5. Lawful Bases
Contract, legal obligation, legitimate interests, and consent.
6. Free Postal Entry
Free entries do not result in marketing unless separate consent is given.
7. Data Sharing
Data may be shared with service providers and regulators where required.
8. Retention
Transactional data up to 6 years; marketing until consent withdrawn.
9. Your Rights
Access, correction, erasure, restriction, objection, withdrawal of consent.
10. Contact
privacy@1in100.co.uk

1in100 – Internal Compliance Note

Purpose
To document GDPR, PECR and Gambling Commission compliance for 1in100.
Data Separation
No legacy customer lists are used for marketing. Old data is used only for suppression.
Consent
Marketing, SMS and push notifications require explicit opt-in.
Consent is recorded with timestamp and source.
Free Entry
Free postal entries are treated equally and do not trigger marketing.
Data Hygiene
Internal and competitor domains are excluded.
Suppression lists are maintained.
Conclusion
1in100 operates a clean, consent-led data model suitable for regulated prize promotions.