Privacy Policy

Who we are

PrizeBox is operated by Project32 Group Ltd (company number 12617834), registered at Henleaze House Business Centre, 13 Harbury Road, Henleaze, Bristol, BS9 4PN. Where this policy says “we”, it means that company.

We are the data controller for this website, prizebox.app, and for enquiries you send us through it.

If you are a player, not an operator

When you register or buy tickets on a competition site built with PrizeBox, that operator is the data controller, not us. They decide what is collected and why. We supply and run the software on their instructions, which makes us a data processor for that data.

So the policy that governs your account is the one on the site you signed up to. If you are unsure which company that is, it is named in the footer of the site you used.

What this website collects

When you send us an enquiry

The contact form asks for your name, email address, company or brand name, and an optional message. We email that enquiry to our team so we can reply. It is not written to a database on this website.

Cookies

One cookie. It is called x-session-id, it lasts 24 hours, and it ties together the requests in a single visit so we can keep the site working and spot abuse. It holds a random identifier and nothing else — no name, no email, nothing that says who you are.

It is set by this site and cannot be read by another website, or by scripts running in your browser. You can delete it at any time in your browser settings, and blocking it does not stop the site working.

We do not set advertising or campaign-tracking cookies here. Our operators’ own competition sites do, because a signup there has to be attributable to the advert that produced it — but those are set on their domain, under their policy, and never travel to this one.

Technical information

Our hosting provider records standard request information, including your IP address. We also use your IP address to limit how many enquiries can be sent from one connection in an hour, which stops the form being used to send spam. Those counters expire on their own.

What we do not do

This website runs no third-party analytics, advertising or tracking scripts. No Google Analytics, no advertising pixels, no session recording. Nothing on this page loads from another company’s server.

Why we are allowed to use it

Under UK GDPR we rely on:

• Legitimate interests — replying to your enquiry, and keeping this site secure and free of abuse.
• Performance of a contract — where we are quoting for, or providing, PrizeBox to your business.
• Legal obligation — where we have to keep records, for example for tax or accounting.

Who else sees it

Three suppliers touch anything you send us through this website. Each only processes data on our instructions:

• Vercel — hosting and content delivery.
• Resend — delivers your enquiry to our inbox.
• Upstash — holds the short-lived counters that stop the form being used to send spam.

Running an operator’s competition site takes more than that — a database, a payment provider and so on. None of it is involved in your visit here, and what applies to a player is set out in that operator’s own policy.

We do not sell personal data, and we do not share it with advertising networks or data brokers. We will disclose data if the law requires it.

Where your data goes

Our servers are in Europe. Some of the suppliers above are based outside the UK. Where data leaves the UK we rely on UK adequacy regulations or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

Signing in with Facebook

Operators can offer Continue with Facebook on their site. The sign-in is our software either way, but it runs against one of two Meta applications — and which one decides who answers for this part of your data.

• The operator’s own application. They registered it with Meta themselves, in their own name. They are the controller for what Meta hands over, under their own privacy policy, and we handle it on their instructions — the same processor relationship as the rest of their site.
• A shared application we operate. Any operator who has not supplied their own runs on it. It is registered to us, so we are the controller for what Meta hands over, under this policy. The account it goes on to create is still the operator’s, and still governed by theirs.

You can tell which one you are on without asking us: the Facebook permission screen names the application and shows its icon. An operator on their own application is never moved onto ours quietly — if their credentials stop working the button disappears rather than changing hands behind the consent screen.

What Meta gives us

• Your name.
• Your email address, if you allow that permission. You can decline it.
• An identifier that is unique to you and to the application you signed in through. It cannot be used to look you up anywhere else, and the identifier one application sees does not match the one another sees.

That is the whole list. We do not ask for your profile picture, and we request no permission beyond your public profile and your email address.

What we do with it

We store the identifier so that we recognise you the next time you sign in, together with the email address Meta asserted at the time as a record of how the connection was made. Your name and email address, where supplied, pre-fill the sign-up form on the operator’s site — you can change them before you finish. The account that gets created belongs to that operator and is governed by their policy.

Where two operators share our application they see the same identifier for you, because it is the same application. We never match those records up: each operator’s copy is looked up only within that operator’s own data, and never across the platform.

What we never do

• We never post anything to Facebook, and we never read your friends, photos or timeline.
• We never use a Facebook-supplied email address to sign you into an account that already exists. Meta gives us no way to verify that an address really belongs to you, so treating it as proof would let someone take over an account by claiming the same address. If the address is already registered we ask you to sign in the way you normally do, and connect Facebook afterwards from your account settings — where being signed in already proves the account is yours.
• We never keep the access token Meta issues. It is used once, immediately, to read the fields above, and then dropped.

Taking it away again

Disconnect it from your account settings on the operator’s site, or remove it from Facebook: Settings & privacy → Settings → Apps and Websites, then Remove. The entry is named after the application you signed in through — the operator’s own name where they run their own application, and PrizeBox where they use ours. Either way, set a password on your account first if you have never used one, or you will have no way left to sign in.

Deleting your data

How to get your data removed, depending on what you want gone.

Disconnect Facebook, keep the account

Sign in on the operator’s site, open your account settings, and disconnect Facebook. If your account was created through Facebook you will be asked to set a password first, so that you are not locked out.

Delete a player account

The operator holds that account, so ask them — their contact details are in the footer of their site. If you cannot reach them, email us at simon@project32group.com from the address on the account, telling us which site it was, and we will pass the request to them and follow it up. You will get a response within 30 days.

Some records survive account deletion because the law requires it: completed transactions and refunds, prize and draw records, and the results of any age or identity check. Those are kept for as long as the relevant financial and regulatory rules demand, and are not used for anything else.

Delete an enquiry you sent us

Email simon@project32group.com and we will delete the correspondence.

How long we keep things

• Enquiries — while we are talking, and for up to 24 months afterwards, so that we can pick up the conversation again.
• Cookies — the lifetimes in the table above.
• Player accounts — set by the operator whose site you registered on, subject to the legal minimums described above.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct it if it is wrong;
• delete it;
• stop or restrict how we use it;
• send it to you, or to someone else, in a portable format;
• stop relying on legitimate interests, where you object to that; and to withdraw any consent you have given, at any time.

Email simon@project32group.com. There is no charge, and we will respond within 30 days.

If you are not happy with how we handle it, you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you came to us first so we can put it right.

Children

Competitions run on PrizeBox are for adults aged 18 and over. This website is aimed at businesses. We do not knowingly collect data from children, and if we learn that we have, we delete it.

Changes to this policy

We will update this page when what we do changes, and the date at the top will change with it. If a change is significant we will tell the operators we work with directly.

Contact us

Email simon@project32group.com, or write to Project32 Group Ltd, Henleaze House Business Centre, 13 Harbury Road, Henleaze, Bristol, BS9 4PN.