Privacy Policy
At VillaWin, we are committed to protecting the privacy and security of our customers and site visitors. We understand the trust you place in us when you provide us with your personal data. This Privacy Policy explains how we collect, use, share and protect your personal data, and the rights you have in relation to it. Please read it carefully.
Via del Premio Limited is the company that operates the website www.villawin.co.uk and any associated apps (the "Website"). Via del Premio Limited is incorporated under the laws of Gibraltar (company number 126740) with registered office at Madison Building, Midtown, Queensway, Gibraltar, GX11 1AA. Any reference in this Privacy Policy to "VillaWin", "we", "us" or "our" is to Via del Premio Limited, which is the data controller responsible for your personal data. We are part of the Winvia group of companies (the "Group").
Because we offer our Services to individuals located in the United Kingdom (including Northern Ireland), the Isle of Man and the Channel Islands, and because we are established in Gibraltar, we handle your personal data in accordance with the UK GDPR and the Data Protection Act 2018, and Gibraltar data protection law (the Gibraltar GDPR and the Gibraltar Data Protection Act 2004), as applicable.
Because we are established in Gibraltar and not in the United Kingdom, we have appointed Best of the Best Limited, a company registered in England and Wales (company number 13335459) with registered office at 2 Plato Place, 72-74 St. Dionis Road, London, England, SW6 4TU, as our representative in the United Kingdom under Article 27 of the UK GDPR. You can contact our UK representative by post at the address above or through the contact form available on the Website, in addition to or instead of contacting us directly, on any matter relating to our processing of your personal data.
1. WHAT THIS POLICY TELLS YOU
• what personal data we collect from you (or which we collect about you) when you use the Website or otherwise interact with us;
• how and why we use that data, and the legal grounds we rely on;
• who we share your data with;
• whether we transfer your data internationally, and how we protect it;
• how long we keep your data and how we keep it secure; and
• your rights over your data, how to exercise them, and how to complain.
2. WHAT INFORMATION DO WE COLLECT AND WHAT DO WE USE IT FOR?
You may provide us with, or we may collect, the following types of personal data when you register with us, enter a Competition (including any Free Competition or promotion), or otherwise interact with us:
• Identity — first name, surname, your login details (username and password), date of birth and country of residence;
• Contact — email address, telephone number, postal address, and the content of messages you send us;
• Financial — payment card or other payment details, billing address, purchase and payment history, and the bank account details you provide so that we can pay you a cash prize or cash alternative (we do not store full payment card details, which are processed by our payment service providers);
• Participation — your Competition entries and Free Entries, your referral link and the referrals credited to your account, and any predictions or answers you submit in our promotions;
• Profile — your marketing preferences, account settings, and any feedback you provide through reviews and surveys;
• Social — if you register or log in using a Facebook, Google or Apple account, the contact information and account identifier associated with that account;
• Verification — information used to verify your age, identity and eligibility, including any documentary evidence (such as photo identification) we ask you to provide.
We also collect the following information when you use the Website, using cookies and similar technologies (see our Cookie Policy):
• Usage — information about how you use the Website, such as the pages you view, time spent on page and click-throughs; and
• Technical — your IP address, browser type, device information, operating system and other identifiers.
When we use your personal data, we must have a legal ground (a "lawful basis") for doing so. We may rely on more than one lawful basis depending on the purpose. The table below sets out how and why we use your personal data and the legal ground we rely on.
Why we use your data Data used Legal ground Register you as a customer Identity, Contact, Profile, Social Performance of a contract with you Enable you to log in to your account Identity, Contact, Social Performance of a contract with you Enable you to enter a Competition or promotional draw, including by free postal entry, in a Free Competition or in a Predict the Score promotion Identity, Contact, Financial, Participation Performance of a contract with you Process the payments you make Identity, Contact, Financial Performance of a contract with you Pay cash prizes and cash alternatives by bank transfer Identity, Contact, Financial Performance of a contract with you Operate our referral programme, including crediting rewards to referrers and verifying that referrals are genuine Identity, Contact, Participation Performance of a contract with you; and our legitimate interests (running and protecting our promotions) Verify your age, identity and eligibility, and prevent and detect fraud and underage participation Identity, Contact, Verification, Technical Compliance with a legal obligation; and our legitimate interests (preventing fraud, crime and underage participation) Draw the Competition and arrange delivery or collection of a prize Identity, Contact Performance of a contract with you Publish and make available limited winner information (such as surname and county or country of residence) and, with your agreement, winner photographs and videos Identity, Contact Our legitimate interests (demonstrating that prizes are genuinely awarded, in line with the CAP Code); consent (photographs and videos); and compliance with regulatory requests Run promotional campaigns and promotional draws, including with our promotional partners (for example, where you register after scanning a promotional QR code at an event or in a partner’s materials) Identity, Contact, Profile, Participation Performance of a contract with you; and our legitimate interests (promoting our services); consent where required Operate our Mindful Play tools and help protect customers from harm Identity, Contact, Profile, Financial Our legitimate interests (customer protection); and compliance with applicable codes of practice Manage inactive accounts, including sending advance notice and archiving Identity, Contact Performance of a contract; and our legitimate interests (keeping data accurate and minimised) Internal administration and record keeping All Performance of a contract; compliance with a legal obligation (e.g. tax); and our legitimate interests (effective administration) Notify you of changes to our Terms and Conditions or policies Identity, Contact Performance of a contract; and compliance with a legal obligation Answer your enquiries and handle complaints Identity, Contact, Profile Performance of a contract; and our legitimate interests (responding to and supporting our customers) Send you marketing about our competitions, products and offers Identity, Contact, Profile Consent; or our legitimate interests where permitted by law (see ‘How to opt out of marketing’ below), in each case with an opt-out Personalise your experience of the Website and the advertising you see Identity, Contact, Profile, Usage, Technical Consent Provide, secure and improve the Website Usage, Technical Our legitimate interests (providing a functional and secure service) Obtain feedback through reviews and surveys Identity, Contact, Profile Our legitimate interests (improving our services) Comply with legal and regulatory obligations and establish, exercise or defend legal claims All Compliance with a legal obligation; and our legitimate interests (protecting our rights)
Referral programme. If you register using a friend’s referral link, we record which account referred you, so that we can credit the reward to that account; your own account is otherwise treated like any other account. Referral invitations are shared personally by the referrer — we do not use details supplied by a customer to send unsolicited invitations to their friends, and we do not market to you on a referrer’s behalf.
Questionnaires and surveys. Where you complete a questionnaire or survey in order to obtain a Free Entry, we use your answers to award the Free Entry and to administer the relevant Free Competition (performance of a contract with you). If we intend to use your answers for any other purpose – for example, improving our services or, with your consent, marketing – we will tell you at the point of collection. Your answers are retained in accordance with the retention periods set out in this Privacy Policy.
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for a compatible purpose. If we need to use it for an unrelated purpose, we will notify you and explain the legal ground that allows us to do so. We may also anonymise and aggregate your personal data so that it no longer identifies you, and use that anonymised data for any purpose.
3. WHO DO WE SHARE YOUR DATA WITH?
We do not sell your personal data, and we do not share it with third parties for them to market their own products or services to you without your consent. We do share your personal data with the following categories of recipient, in each case only to the extent necessary and subject to appropriate confidentiality and security obligations:
• our payment service providers, to process your payments and to pay out cash prizes and cash alternatives;
• the providers of our website, hosting and e-commerce platform;
• our free postal entry handler and our prize delivery and fulfilment partners;
• our analytics, advertising and marketing providers;
• identity, age-verification and fraud-prevention providers;
• Aston Villa Football Club Limited ("Aston Villa"), where necessary in connection with a Competition, promotion or prize involving Aston Villa, including to administer or facilitate the Competition or promotion, verify eligibility, contact or verify winners, arrange or fulfil prizes and facilitate attendance at Villa Park or other Aston Villa premises. Where you have separately opted in to receive marketing from Aston Villa, we may also share your name, contact details and any other information identified at the point of consent with Aston Villa so that it can send you marketing communications in accordance with that consent. Aston Villa will process personal data received for its own marketing purposes as an independent controller and in accordance with its own privacy policy. You can withdraw your consent to receive Aston Villa marketing at any time;
• our promotional partners, where we run a Competition or promotional campaign together with a third party (for example, a sports club or another brand partner): if you enter that Competition or promotion, we may share with the relevant partner the personal data necessary to organise and run it (for example, to confirm entries or award prizes) and, only where you have given your consent, your contact details so that the partner can send you its own marketing;
• our professional advisers, including auditors, lawyers and other advisers, and any independent draw or verification service we use;
• other companies within the Winvia Group, which provide us with support services (including customer service, fraud prevention and the technology platform on which the Website operates) and, where you have consented, marketing;
• a buyer or prospective buyer of our business, if we sell or reorganise all or part of it; and
• courts, regulators, law enforcement and other authorities, where we are required or permitted by law to do so.
4. INTERNATIONAL TRANSFERS OF YOUR DATA
Because we are established in Gibraltar and use service providers within the Winvia Group, your personal data may be transferred between Gibraltar and the United Kingdom. Gibraltar and the UK each recognise the other as providing an adequate level of data protection, so these transfers are permitted without further safeguards. Where we transfer your personal data to a country outside the UK, Gibraltar or the European Economic Area that has not been recognised as providing an adequate level of protection, we put in place appropriate safeguards (such as the UK International Data Transfer Agreement or Addendum, or the European Commission’s standard contractual clauses) to ensure your data remains protected.
If you would like more information about these safeguards, please contact us using the details below.
5. HOW WE KEEP YOUR DATA SECURE
We adopt industry-standard security measures to keep your personal data safe and to prevent unauthorised access, use, loss or disclosure, and we require the third parties we work with to apply suitable confidentiality and security standards. However, the transmission of data over the internet is not completely secure, and we cannot guarantee the security of any data you transmit to us over the internet; any such transmission is at your own risk.
6. HOW LONG DO WE KEEP YOUR DATA FOR
We keep your personal data for as long as you hold an account with us and we have a legal ground to do so. As a general rule:
• account and participation data is kept while your account is open;
• if you do not log in for 12 (twelve) months, your account becomes inactive (see our Terms and Conditions): we will notify you in advance, and inactive accounts are archived, with their data retained only for as long as needed;
• after your account is closed, we typically retain transactional records, winner records and verification records for up to 6 (six) years from the end of the relevant tax year or the closure of your account, to meet our tax, accounting and audit obligations and to establish, exercise or defend legal claims; and
• we keep your marketing preferences, including any opt-out, for as long as necessary to honour them.
Once we no longer need your personal data, we securely delete or anonymise it.
7. COOKIES
We use cookies and similar technologies on the Website. For full details of the cookies and trackers we use, their purposes, and how you can manage your preferences, please see our Cookie Policy on the Website and the cookie preference centre referred to in it.
8. LINKS TO THIRD PARTY WEBSITES
The Website may contain links to other websites. Once you leave the Website, we have no control over those third-party websites and are not responsible for the protection or privacy of any information you provide while visiting them. Your use of those sites is not governed by this Privacy Policy, and you should review the privacy and cookie policies that apply to them.
9. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time. The current version will always be available on the Website, so please check back regularly. If we make any significant changes, we may also notify you by email where appropriate.
10. YOUR RIGHTS
Subject to applicable law, you have the following rights in relation to your personal data:
• to access a copy of the personal data we hold about you;
• to have your personal data corrected or updated (you can update much of this yourself in your account);
• to ask us to erase your personal data;
• to ask us to restrict our processing of your personal data;
• to object to our processing of your personal data where we rely on our legitimate interests, including to object at any time to direct marketing;
• to ask us to transfer your personal data to you or another organisation (data portability);
• where we rely on your consent, to withdraw that consent at any time (although we may continue to process your data if we have another lawful basis); and
• rights in relation to automated decision-making and profiling that produces legal or similarly significant effects.
Some of these rights only apply in certain circumstances. Exercising your rights is free of charge. If you wish to exercise any of them, please contact us using the details below. We will respond within 1 (one) month of receiving your request; for complex or repeated requests we may extend this by up to 2 (two) further months, in which case we will tell you. We may need to verify your identity or ask you to clarify your request, and where we do, the response period runs from the point at which we receive the verification or clarification.
11. COMPLAINTS ABOUT OUR USE OF YOUR DATA
If you believe that we have not handled your personal data properly, you have the right to complain directly to us. You can do so by email at dpo@villawin.co.uk, by post using the details in clause 13 below, or through the data complaints form on the Website. We will acknowledge your complaint within 30 (thirty) days of receiving it, look into it without undue delay, and inform you of the outcome and of any steps we have taken.
You also have the right to complain to a data protection regulator. In the United Kingdom, this is the Information Commissioner’s Office (ICO) (www.ico.org.uk); in Gibraltar, this is the Gibraltar Regulatory Authority (GRA) (www.gra.gi). We would, however, appreciate the opportunity to address your concerns before you approach a regulator, so please consider contacting us first.
12. HOW TO OPT OUT OF MARKETING
We send you marketing about our competitions, products and offers only where you have opted in, or where the law allows us to rely on the "soft opt-in" – that is, where you are an existing customer, the marketing relates to our own similar competitions, products and services, and you were given a clear and simple opportunity to opt out when we collected your details. Every marketing message we send contains an easy way to opt out.
You can opt out of our marketing at any time, either by contacting us or by using the unsubscribe link in any marketing email or the opt-out details in any marketing message, and we will act on your opt-out promptly. Please note that we may still need to send you service communications (for example, to confirm an entry, to tell you about changes to our terms or policies, or about a Competition you have entered); these are not marketing. If you have consented to receive marketing from one of our promotional partners, you can withdraw that consent at any time by contacting us or the relevant partner directly.
13. CONTACT US
If you have any questions about this Privacy Policy, wish to exercise your rights, or would like to make a complaint, please contact us:
• by email at dpo@villawin.co.uk; or
• by post at Via del Premio Limited, Madison Building, Midtown, Queensway, Gibraltar, GX11 1AA, or in the UK, at Best of the Best Limited, 2 Plato Place, 72-74 St. Dionis Road, London, England, SW6 4TU