freesbee
Privacy Policy

The shortest
honest version.

What we collect, why we collect it, who we share it with, and the rights you have over it, all in plain English. The legal language sits behind it, but you shouldn't need a lawyer to read it.

Section 01

About this policy

This Privacy Policy explains what personal data we collect when you use Freesbee (the “Platform”), why we collect it, who we share it with, and the rights you have over it. It is written in plain English on purpose. The legal language sits behind it, but you shouldn't need a lawyer to read it.

  1. 1.1
    This policy applies to everyone who uses the Platform, whether you hold an account, enter a draw by post, or just visit the site.
  2. 1.2
    It sits alongside our Terms & Conditions and our Cookie Policy. Where those documents and this one overlap (e.g. on postal entries), this policy controls everything to do with personal data; the Terms control everything else.
  3. 1.3
    We are governed by UK data protection law: the UK GDPR and the Data Protection Act 2018. Our regulator is the Information Commissioner's Office (ICO). Our ICO registration number is ZA8842901.
Section 02

Who we are

Freesbee Ltd is the “data controller” for everything described in this policy, meaning we are the organisation that decides what data is collected, why, and what happens to it.

  1. 2.1
    Freesbee Ltd, company number 17293216, registered office at 82A James Carter Road, Mildenhall, IP28 7DE, United Kingdom.
  2. 2.2
    Our Data Protection Officer (DPO) is the named contact for any data question or request. Write to dpo@freesbee.co.uk or use the postal address above, marked for the attention of the DPO.
  3. 2.3
    We never use a third party to act as a data controller on our behalf. Where we use processors (payment providers, delivery partners, hosting) we list them in section 8.
Section 03

What data we collect

We collect only the data we need to run a Competition and pay a winner, no more. Below is the full list, grouped by where it comes from.

  1. 3.1
    Account data. Full name, postal address with postcode, date of birth, email address, and phone number. We collect these once at signup and store them on your account so we can attach entries to a verified identity.
  2. 3.2
    Payment data. Card payments are handled by our PCI-DSS compliant payment processor (Stripe). We never see or store your full card number, CVV or expiry, only a tokenised reference and the last four digits, used to show you which card paid for an order.
  3. 3.3
    Entry & activity data. Which Competitions you've entered, when, how many entries, and the resulting ticket numbers. For paid orders we keep the order ID, total, and payment method. For postal entries we keep the date of receipt and a reference to your account, but not the postcard itself (see section 5).
  4. 3.4
    Subscription data. Your active tier, billing date, credit balance, and the draws you have opted into.
  5. 3.5
    Support correspondence. Emails to and from our support team and notes our team add when handling your enquiry.
  6. 3.6
    Technical data. Your IP address, browser and operating system, and high-level page actions on the Platform (e.g. “viewed prize page”, “added to cart”). Collected via our first-party analytics. See section 7.
Section 04

How we use your data

Under UK GDPR, every use of personal data must have a lawful basis. Below is exactly what we do with your data, and the basis we rely on for each purpose.

  1. 4.1
    To run a Competition you entered. Lawful basis: performance of a contract. We use your account data and entry data to confirm your entry, assign a ticket number, run the draw, and contact you if you win.
  2. 4.2
    To verify identity and age. Lawful basis: legal obligation. We are required to confirm winners are over 18 and ordinarily resident in the UK before releasing a prize, and to carry out checks against anti-money-laundering rules for cash prizes.
  3. 4.3
    To take payment. Lawful basis: performance of a contract. Card data passes through Stripe; we receive a tokenised reference back so the entry can be linked to a payment.
  4. 4.4
    To send service messages. Lawful basis: performance of a contract. These are emails about something you did: order receipts, entry confirmations, postal-entry confirmations, draw results for Competitions you entered. You cannot opt out of these and still use the Platform.
  5. 4.5
    To send marketing. Lawful basis: consent. Newsletter and promotional emails only go to people who opted in at signup or in account settings. Every marketing email has a one-click unsubscribe link. See section 6.
  6. 4.6
    To prevent fraud and abuse. Lawful basis: legitimate interest. We monitor entry patterns, payment chargebacks, and account behaviour to detect duplicate accounts, fraudulent entries, and chargeback abuse. We balance this against your privacy by collecting only the data needed and reviewing access internally.
  7. 4.7
    To improve the Platform. Lawful basis: legitimate interest. We use anonymised, aggregated analytics to understand which pages and prizes are popular. No marketing profile is built about you as an individual.
Section 05

Postal entries: handwritten data

We deliberately keep postal-entry data in our systems for as short a time as possible. The postcards you send us are processed manually, then destroyed.

  1. 5.1
    What we receive. Your handwritten name, postal address, date of birth, account email, optional phone number, the competition you wish to enter, and your signed T&C declaration. Required fields are listed in clause 6.2 of our Terms & Conditions.
  2. 5.2
    How we process it. On the day of receipt, a member of the compliance team matches the email on the postcard to your account, registers the entry against your account, and the ticket number is assigned from the same range as paid entries.
  3. 5.3
    What we retain. On your account we keep only that you submitted a postal entry, when, into which Competition, and your assigned ticket number. We do not retain a digital scan or photograph of the postcard.
  4. 5.4
    What we destroy. The postcard itself is securely destroyed within 14 days of the relevant draw being verified. Until that point it is held in a locked compliance facility accessible only to named staff.
  5. 5.5
    Why we destroy it. Once the draw is over, the postcard is no longer required for the contract (running the Competition) or any legal obligation (winner verification). Holding it longer would breach the storage-limitation principle of UK GDPR, so we don't.
  6. 5.6
    If you change your mind. Once a postcard has been registered as an entry, the entry stands until the draw runs. You can ask us to delete your account data afterwards under section 11, but we cannot retrieve the postcard, as it will have been destroyed.
Section 06

Marketing communications

Marketing emails are opt-in only and never used to chase abandoned baskets, push subscriptions, or run targeted retargeting elsewhere on the web.

  1. 6.1
    You choose at signup whether to receive marketing emails. You can change your mind at any time in your account settings, or by clicking the unsubscribe link in any marketing email.
  2. 6.2
    We send at most one newsletter per fortnight, focused on upcoming draws, winners, and product updates. We do not sell, lend or share your email address with any third party for marketing.
  3. 6.3
    Unsubscribing from marketing does not affect service messages (order receipts, entry confirmations, draw results). Those are part of the contract for entering a Competition.
Section 07

Cookies & analytics

We use a small set of first-party cookies and no third-party advertising cookies. Our full Cookie Policy lists each one by name with its purpose and expiry.

  1. 7.1
    Strictly necessary cookies. Required for the Platform to function: keeping you signed in, holding your cart, remembering whether you accepted cookies. These do not require consent under UK law.
  2. 7.2
    Analytics cookies. First-party, self-hosted analytics that count page views and broad interaction patterns. Data is anonymised at collection time and never linked to your account. Drops if you don't accept analytics in the cookie banner.
  3. 7.3
    Preference cookies. Remember your accessibility and display preferences. Optional; cleared on logout.
  4. 7.4
    No third-party advertising cookies are loaded on the Platform. No Facebook Pixel, no Google Ads tag, no programmatic ad-tech.
Section 08

Who we share your data with

We share data only with the processors we need to run Competitions, deliver prizes, meet legal duties, and protect the Platform. We never sell your data.

  1. 8.1
    Stripe (payments). Processes card payments under their own privacy policy and PCI-DSS controls. They receive your name, billing address, card details (which we never see) and order amount.
  2. 8.2
    Royal Mail / DPD / FedEx (delivery). Receives the winner's name, delivery address and contact number for prizes that need to be physically delivered.
  3. 8.3
    Postmark / SendGrid (email). Sends transactional and marketing emails on our behalf. Receives your email address and the contents of the email.
  4. 8.4
    Our accountants and auditors. Receive transaction records as part of our annual audit. They are bound by professional confidentiality.
  5. 8.5
    Law enforcement, regulators, courts. Where we are legally required to disclose data, for example under a court order or a valid request from HMRC or the Gambling Commission.
  6. 8.6
    We do not share data with marketing networks, data brokers, or ad-tech vendors. We do not sell your data under any circumstances.
Section 09

International transfers

Most of our processing happens in the UK. Where data leaves the UK, we make sure it is protected to UK GDPR standards.

  1. 9.1
    Our hosting, support team and compliance facility are based in the United Kingdom.
  2. 9.2
    Stripe processes a small amount of payment data in the United States. The transfer is covered by the UK Addendum to the EU Standard Contractual Clauses and Stripe's UK Data Privacy Framework certification.
  3. 9.3
    We do not transfer data outside the UK / European Economic Area for any other purpose.
Section 10

How long we keep data

Different categories of data have different retention windows. We keep data only as long as we need it for the purpose it was collected, plus any retention period required by law.

  1. 10.1
    Account data. Held while your account is open, and for up to 7 years after closure to meet HMRC record-keeping requirements. After 7 years it is securely deleted.
  2. 10.2
    Entry & order data. Held for 7 years from the order date for tax and audit purposes, then deleted.
  3. 10.3
    Postal entry postcards. Destroyed within 14 days of the relevant draw being verified (see section 5).
  4. 10.4
    Marketing consent records. Held while you are subscribed and for 2 years after you unsubscribe, so we can prove you did consent if questioned.
  5. 10.5
    Support emails. Held for 3 years from the last message in the thread, then deleted.
  6. 10.6
    Server and access logs. Held for 12 months for security and fraud-prevention purposes, then deleted.
Section 11

Your rights

UK GDPR gives you a set of rights over your personal data. You can exercise any of them by emailing dpo@freesbee.co.uk. We respond within one calendar month.

  1. 11.1
    Access. Ask us for a copy of the personal data we hold about you, what we use it for, and who we share it with.
  2. 11.2
    Rectification. Ask us to correct any data that is inaccurate or incomplete. Most account fields you can edit yourself in account settings.
  3. 11.3
    Erasure. Ask us to delete your data. We will, unless we have a legal duty to keep it (e.g. tax records). We'll explain what stays and why.
  4. 11.4
    Restriction. Ask us to pause processing of your data while we look into a query or complaint about it.
  5. 11.5
    Portability. Ask us to send a copy of your data in a machine-readable format, or send it directly to another controller you nominate.
  6. 11.6
    Objection. Object to processing based on legitimate interests, or to direct marketing at any time.
  7. 11.7
    Withdraw consent. Where we rely on consent (marketing), you can withdraw it without affecting the lawfulness of processing that happened before you withdrew.
Section 12

Security

We protect your data with a layered set of technical and organisational measures, reviewed annually.

  1. 12.1
    All data in transit is encrypted with TLS 1.3. All data at rest is encrypted with AES-256.
  2. 12.2
    Access to personal data inside our team is role-based and audit-logged. No one on the team can read your password. It is one-way hashed.
  3. 12.3
    We carry out penetration testing against the Platform at least annually. We disclose material incidents to the ICO within 72 hours, and to affected users without undue delay.
Section 13

Children's data

Our Competitions are 18+ and our Platform is not directed at or designed for children.

  1. 13.1
    We do not knowingly collect data on anyone under 18. Age is verified at signup, and again at winner verification before any prize is released.
  2. 13.2
    If we become aware that a child has signed up, we close the account and delete the data immediately. If you believe a child has supplied us with data, write to dpo@freesbee.co.uk.
Section 14

Changes to this policy

We update this policy when our product, processors, or the law changes. The current version is always the one published on the Platform.

  1. 14.1
    The current version, date of last update, and date the changes take effect are shown in the rail at left.
  2. 14.2
    Material changes (anything affecting how we use your data or your rights over it) are communicated by email to every account holder at least 14 days before they take effect.
  3. 14.3
    Minor wording changes are published silently, with the version number incremented.
Section 15

Contact & complaints

If you have a privacy question, want to exercise a right, or are unhappy with how we have handled your data, please talk to us first. We'll respond within one calendar month.

  1. 15.1
    Data Protection Officer. dpo@freesbee.co.uk, or by post to Freesbee Ltd, FAO the DPO, 82A James Carter Road, Mildenhall, IP28 7DE.
  2. 15.2
    General privacy queries. privacy@freesbee.co.uk.
  3. 15.3
    Right to complain to the ICO. If we have not resolved your concern, you have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk, by phone on 0303 123 1113, or in writing at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Need something this page didn't cover?

Privacy questions, requests to exercise a right, or a concern about how we've handled your data: write to our DPO and we'll come back within one calendar month.

Email the DPO