Your Data Rights (UK GDPR)

Your Rights Under UK GDPR

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 grant you specific rights regarding how organizations collect, use, and store your personal data. At PrizeCarousel, we respect these rights and provide clear processes for exercising them.

This page explains each of your data protection rights in detail and provides practical guidance on how to exercise them. For broader information about our data practices, please see our Privacy Policy.

We are committed to responding to all legitimate requests within the timescales required by law, typically within one month of receiving your request. In some cases involving complex or numerous requests, this may be extended to three months, but we will always inform you of any delays and the reasons for them.

1. Right to Access (Subject Access Request)

You have the right to request access to the personal data we hold about you. This is commonly called a "Subject Access Request" or SAR.

What You Can Request

• Confirmation of whether we process your personal data
• Access to your personal data in our possession
• Information about why we process your data
• Details about who we share your data with
• How long we retain your data
• Information about your other rights
• Details about data sources (if not collected directly from you)

How to Request Access

Email privacy@prizecarousel.games with the subject line "Subject Access Request" and include:

• Your full name and contact email address
• Any other information that helps us locate your data (dates of contact, etc.)
• Specific information you're seeking (or request all personal data)
• Proof of identity if requested by us for security purposes

Timeline: We will respond within one month of receiving your request.

Cost: Free, unless requests are manifestly unfounded, excessive, or repetitive.

2. Right to Rectification

You have the right to have inaccurate or incomplete personal data corrected or completed.

When to Use This Right

• We hold incorrect information about you
• Personal data is incomplete and needs additional information
• Your circumstances have changed and data is now outdated

How to Request Rectification

Contact us at privacy@prizecarousel.games and provide:

• The inaccurate or incomplete data you want corrected
• The correct or complete information
• Supporting evidence if applicable

We will correct the data and notify any third parties we've shared it with, unless this is impossible or involves disproportionate effort.

Timeline: Corrections made within one month of request.

3. Right to Erasure ("Right to be Forgotten")

In certain circumstances, you have the right to request deletion of your personal data.

When Erasure Applies

You can request erasure when:

• The data is no longer necessary for the purpose it was collected
• You withdraw consent that was the basis for processing
• You object to processing and there are no overriding legitimate grounds
• Personal data was unlawfully processed
• Erasure is required to comply with a legal obligation

When Erasure May Not Apply

We may refuse erasure if retention is necessary for:

• Compliance with legal obligations
• Establishment, exercise, or defense of legal claims
• Public interest purposes (e.g., public health)

How to Request Erasure

Email privacy@prizecarousel.games with your deletion request, specifying which data you want deleted and your reason for the request.

Note: Given the minimal data we collect, most users have limited personal data to erase. Cookie-based data can be deleted simply by clearing your browser cookies.

Timeline: Erasure completed within one month of request, if applicable.

4. Right to Restrict Processing

You can request that we limit how we use your personal data while maintaining storage of the data.

When to Restrict Processing

• You contest the accuracy of data (restriction during verification)
• Processing is unlawful but you don't want data erased
• We no longer need the data but you need it for legal claims
• You've objected to processing (restriction pending verification)

What Restriction Means

During restriction, we can store your data but not use it, except:

• With your consent
• For legal claims
• To protect another person's rights
• For important public interest reasons

How to Request Restriction

Contact privacy@prizecarousel.games explaining why you want processing restricted and which grounds apply to your situation.

Timeline: Implemented within one month of request.

5. Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.

When Portability Applies

This right applies when:

• Processing is based on your consent or a contract
• Processing is carried out by automated means

What You Can Request

• Receive your data in a portable format (e.g., CSV, JSON)
• Have your data transmitted directly to another service (where technically feasible)

How to Request Data Portability

Email privacy@prizecarousel.games requesting portable data and specify your preferred format if you have one.

Note: Given our minimal data collection, portable data will typically be limited to any contact information you've provided.

Timeline: Provided within one month of request.

6. Right to Object

You have the right to object to processing of your personal data in certain circumstances.

Objection to Legitimate Interests

If we process your data based on legitimate interests, you can object. We must then stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Objection to Direct Marketing

You have an absolute right to object to direct marketing at any time. We must immediately stop such processing upon objection.

Objection to Automated Decision-Making

You can object to decisions made solely by automated processing that produce legal or similarly significant effects. Note: PrizeCarousel does not engage in automated decision-making of this nature.

How to Object

Contact privacy@prizecarousel.games stating your objection and the processing you object to.

Timeline: Processing stopped immediately for direct marketing; within one month for other objections after assessing grounds.

7. Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time.

What This Affects

At PrizeCarousel, consent-based processing primarily covers:

• Analytics cookies
• Optional tracking and usage analytics

How to Withdraw Consent

You can withdraw consent by:

• Adjusting your cookie preferences in the cookie banner
• Clearing cookies in your browser settings
• Emailing privacy@prizecarousel.games

Important: Withdrawing consent does not affect the lawfulness of processing based on consent before withdrawal. Essential cookies necessary for site functionality cannot be disabled.

How to Exercise Your Rights

To make any request related to your data rights, follow these steps:

Step 1: Contact Us

Email our privacy team at privacy@prizecarousel.games with:

• Clear subject line indicating your request type (e.g., "Subject Access Request")
• Your full name and contact information
• Specific details about your request
• Any information that helps us locate your data

Step 2: Identity Verification

To protect your privacy, we may ask you to verify your identity before processing certain requests. This might involve:

• Confirming details only you would know
• Responding from the email address we have on file
• Providing additional identification if necessary for security

Step 3: Processing Your Request

We will:

• Acknowledge receipt of your request promptly
• Process your request within one month (or inform you of any delay)
• Provide the information, make changes, or explain why we cannot fulfill the request
• Inform you of your right to complain to the ICO if you're dissatisfied

No Fee Required

Exercising your data rights is free of charge. We may only charge a reasonable fee or refuse requests that are manifestly unfounded, excessive, or repetitive.

Making a Complaint

If you're unhappy with how we've handled your data or responded to a request, you have the right to complain to the UK supervisory authority:

We encourage you to contact us first at privacy@prizecarousel.games so we can try to resolve your concerns directly. However, you have the absolute right to contact the ICO at any time.

Additional Resources

For more information about data protection and your rights:

• ICO Website: Your Data Matters - Consumer-friendly guides to data rights
• Our Privacy Policy: Comprehensive information about our data practices
• Contact Page: All ways to get in touch with our team