Privacy policy

Last updated: 3 October 2026

This Privacy Policy explains how DBX Dream Draws collects, uses, stores and shares personal information when you visit our website, create an account, enter a promotion, make a payment, receive or withdraw a prize, contact us or otherwise use our services.

1. Who we are

For the purposes of UK data protection law, the controller responsible for the personal information described in this policy is:

DBX Dream Draws
11 Ashford Road
Patchway
Bristol
BS34 5DX
United Kingdom
Email: dbarker99@dbxdreamdraws.co.uk

2. Information we collect

Depending on how you use DBX Dream Draws, we may collect:

Account and identity information — your name, email address, date of birth, account identifiers and other information you give us when creating or maintaining an account. Passwords are never stored in readable form; we keep only a secure cryptographic hash.
Contact information — your email address, mobile number where provided, postal address where needed, and the content of your communications with us.
Competition and entry information — the promotions you enter, entry numbers, answers to entry questions, entry method, dates and times of entry, prizes and winner information.
Payment and transaction information — purchases, wallet deposits, refunds, cash balances, site credit, DBX Points and transaction history. Card details are entered directly into our payment provider's secure systems; we do not receive or store full card numbers or security codes.
Withdrawal information — the bank or PayPal details needed to make a payment to you, with related transaction and verification records. Bank account details are masked once a withdrawal has been paid; we keep limited records where needed for accounting, fraud prevention, disputes or legal obligations.
Free postal entry information — the details included with a postal entry, such as your name, contact details and the promotion you want to enter.
Verification information — where reasonably necessary, information or documents to verify your identity, age, address, eligibility, payment ownership or withdrawal details.
Technical and security information — for each device you sign in on, the IP address, browser type and sign-in times, so you can see and sign out your devices and we can protect accounts. These records are deleted 90 days after the device was last used. Admin actions, and staff viewing a customer's records, are logged.
Notifications and support — the messages we show in your account and email you (entries, wins, withdrawals, refunds, security), and support conversations with our internal notes.
Fraud and abuse checks — automated rules may flag patterns (for example, the same phone number on several accounts, or repeated failed payments) for a member of staff to review. A flag never blocks, closes or penalises an account by itself; a person decides, and you can ask us about any decision.
Site usage counts — we count, on our own server, how many visits reach each step (home page, competition, basket, checkout, purchase) by day, device type and competition. These counts contain no cookies, identifiers or IP addresses and can't be linked to you.
Communications — correspondence, contact-form messages, support enquiries and complaints you send us.

3. How and why we use your information

We process personal information only where we have an appropriate lawful basis. Depending on the activity, we use your information to:

create and run your account;
accept and record entries;
run draws and instant-win promotions;
process payments;
manage cash balances, site credit and DBX Points;
contact and verify winners and deliver or pay prizes;
process withdrawals and refunds;
provide customer support and investigate complaints;
keep our systems secure and prevent fraud, duplicate accounts and misuse;
apply age checks, spending limits and breaks;
meet legal, tax, accounting and regulatory obligations;
establish, exercise or defend legal claims;
keep records showing that promotions were run fairly; and
send marketing where you have agreed to it.

Our lawful basis may be that the processing is necessary to perform our contract with you (or to take steps at your request before entering one), necessary to comply with a legal obligation, necessary for our legitimate interests, or based on your consent.

Where we rely on legitimate interests, those include protecting the security and integrity of our service, preventing fraud, running our business, handling disputes and improving our services. We weigh those interests against your rights and interests.

4. Age and eligibility

DBX Dream Draws is only for adults aged 18 or over. We use your date of birth and, where reasonably necessary, verification information to enforce our age requirement and protect the integrity of our promotions. If we become aware that an account was created by someone who is not eligible, we may restrict or close it and handle the related information in line with the law.

5. Payments

Payments are processed by Stripe. Stripe processes information under its own terms and privacy policy and may carry out fraud-prevention and security checks, including checking the card type so that we can refuse credit cards.

Where reasonably necessary, we share personal information with organisations that help us run DBX Dream Draws, such as:

payment and banking providers (Stripe, PayPal and our bank);
website hosting and infrastructure providers;
email providers that deliver our messages;
identity, security and fraud-prevention providers;
professional advisers such as accountants, insurers and lawyers;
delivery or fulfilment providers where needed to supply a prize; and
public authorities, courts, law-enforcement bodies or other organisations where disclosure is legally required or reasonably necessary to protect legal rights.

Service providers acting for us may use personal information only for the purposes we authorise and under appropriate contractual protections. We do not sell your personal information.

7. International transfers

Some service providers may process personal information outside the United Kingdom. Where UK data protection law requires safeguards for such a transfer, we use an appropriate lawful mechanism, such as UK adequacy regulations or approved contractual safeguards. Contact us for more information about the safeguards relevant to you.

8. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose it was collected for, and for any legal, accounting, tax, fraud-prevention, dispute or record-keeping requirements. Different categories of information may therefore be kept for different periods. We consider the nature and sensitivity of the information, why we need it, legal requirements, the risk of fraud or disputes, and whether we could achieve the same purpose with less information. Information we no longer need is securely deleted or anonymised.

Typical periods: device sign-in records 90 days after last use; read notifications 1 year; financial records (orders, payments, wallet, withdrawals, prize fulfilment) 6 years; postal entry details 2 years after the competition; support cases 3 years after they're resolved. Ticket numbers in completed draws, draw records and the security audit log are kept permanently so every result can be verified — if you close your account, your name and email on those records are replaced.

9. Winner information

To show that prizes are genuinely awarded, we publish limited winner information: normally the winner's first name and surname initial, with the prize or promotion. Entry lists show entry numbers with the same shortened names. We never publish a winner's home address. Photographs, testimonials, videos or other publicity are only used where we have an appropriate lawful basis and, where required, your permission.

10. Marketing

We send marketing emails only where you have opted in (for example, by ticking the box when you sign up), and you can withdraw consent at any time in your account settings or using the unsubscribe option in any marketing email. Unsubscribing does not stop essential service messages such as entry confirmations, security notices, withdrawal updates or winner notifications.

11. Cookies

We use one strictly necessary cookie and no advertising or tracking cookies. See our Cookie Policy for details. If we ever introduce cookies that need consent, we will ask for it first.

12. Security

We use appropriate technical and organisational measures to protect personal information against accidental or unlawful loss, alteration, disclosure, destruction or unauthorised access, including encrypted connections (HTTPS), hashed passwords and restricted administrative access. No online service can guarantee absolute security. Please keep your login details confidential and contact us promptly if you think your account has been compromised.

13. Your data protection rights

Depending on the circumstances and the lawful basis for processing, you may have the right to:

be informed about how your information is used;
access your personal information;
have inaccurate or incomplete information corrected;
have information erased in certain circumstances;
restrict processing in certain circumstances;
object to certain processing;
data portability in certain circumstances; and
rights relating to certain automated decision-making, where applicable.

These rights are not absolute and may not apply in every situation. To exercise a right, email dbarker99@dbxdreamdraws.co.uk or use our contact form. We may need to verify your identity before completing a request.

14. Right to object

Where we process your information on the basis of legitimate interests, you may have the right to object. You always have the right to object to the use of your information for direct marketing; if you do, we will stop using it for that purpose.

15. Complaints about personal information

If you have concerns about how we use your personal information, please contact us first so we can investigate. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

16. Changes to this policy

We may update this policy to reflect changes to our services, suppliers, practices or legal obligations. Where a change is significant, we will take reasonable steps to bring it to your attention. The current version and its last-updated date are always available on this page.

17. Contact us

For questions, privacy requests or complaints: