Privacy policy for prize competitions
We take the protection of your personal data and compliance with data protection laws seriously. Below, we explain which personal data we process, for which purposes and on which legal basis.
1. Who is responsible for data processing?
HolidayPirates GmbH, Neue Grünstrasse 18, 10179 Berlin, Germany, is the data controller. You can contact the Data Protection Officer of HolidayPirates GmbH at [email protected].
2. Which categories of personal data are processed?
We process the contact data listed below, as well as log data generated when you use our IT systems.
2.1 Information you provide by entering a competition:
Depending on how the competition is run, this may include:
- Your social media account name
- Comments, messages or other replies you send us as part of your entry
- Your name and email address, if you enter via an online form
2.2 Information about the winner:
To contact the winner and deliver the prize, we also process the winner's first name, surname and email address. Depending on the prize, we may also process:
- Postal address, for prizes that need to be sent out
- Bank account details (account holder name, account number and sort code), for cash prizes paid by bank transfer
- Proof of age and residency, to confirm eligibility to win
3. Where does this data come from?
The data comes directly from the entrant, as it is collected when they enter the competition and, in the winner's case, when they claim the prize.
4. For which purposes is my data processed, and on what legal basis?
a. Art. 6 para. 1 b) GDPR / UK GDPR
We process personal data to run the competition and fulfil our obligations to entrants. This includes selecting and contacting the winner, verifying eligibility and delivering the prize. We use the data you provide when entering the competition and, for the winner, the data listed in section 2.2.
b. Art. 6 para. 1 a) GDPR / UK GDPR
If you have given us your consent to process data, we do so for the purposes explained when you gave that consent. You can withdraw your consent at any time.
c. Art. 6 para. 1 f) GDPR / UK GDPR
We process your data to protect our own legitimate interests or those of third parties. This applies in particular to internal communication between affiliated companies, other administrative purposes and preventing fraudulent or multiple entries.
5. Will my data be shared?
Within our company and group of companies, only the employees who need your data to fulfil our contractual or legal obligations will have access to it.
Where needed to deliver the prize, we share the winner's data only with the service providers involved, such as payment providers for bank transfers or delivery companies for physical prizes.
The winner's social media account name or first name may be shared publicly when the winner is announced, as set out in the competition terms and conditions.
Where a competition takes place on a social media platform such as Instagram, Facebook or TikTok, that platform is not a sponsor of the competition and is not associated with it. The platform's own privacy policy applies to your use of it.
6. What are my rights?
Entrants have the following rights:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
Where we rely on our legitimate interest (Art. 6 para. 1 f) GDPR) as the legal basis, you have a right to object under Art. 21 GDPR.
Under Art. 21 GDPR, you have the right to object to the processing of your personal data at any time. If you object, we will no longer process your personal data for direct marketing purposes or related profiling.
We will also stop processing your personal data for other purposes after your objection, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims (Art. 21 para. 1 GDPR). In this case, you must explain the reasons for your objection arising from your particular situation.
7. Do I have a right to complain?
Yes. You can complain directly to us or to the competent data protection authority. If you are based in the UK, this is the Information Commissioner's Office (ICO), ico.org.uk.
We value transparency, so please don't hesitate to contact us if you have any questions.
8. How long will my data be stored?
We store entrants' data only for as long as needed to run the competition. Unless it is needed for legal purposes, we delete it once the competition has ended and the winner has been confirmed.
We keep the winner's data for as long as needed to deliver the prize. After that, we keep only what we are legally required to retain for accounting and tax purposes (in particular under § 257 HGB and § 147 AO), for up to 10 years.
Where data needs to be kept to enforce legal claims, it may be retained until the relevant limitation periods expire. These can be up to 30 years, although the regular limitation period is three years.
If your data is used for advertising purposes, we will only process it until you object, withdraw your consent or the use is no longer permitted by law.
9. Do I have to provide my data?
To enter a competition, you need to provide the data necessary to take part. If you win, you will need to provide the data necessary to verify your eligibility and receive the prize. Without this data, we cannot accept your entry or deliver the prize.
