Privacy Policy

Introduction -

Hello! Welcome to ‘Change Your Luck’s Privacy Policy.

Change Your Luck is committed to protecting and respecting your personal data. This policy informs you of the steps we take to look after and process your personal data when visiting and using the website regardless of where you have visited the site from.

Here we inform you about your privacy rights and the protections the law offers you. This is not an exhaustive list of rights.

A glossary is provided to help you understand the meaning of terms used within the privacy policy.

This policy is an outline on what we will do with your data IF we decide to collect that data. There is no guarantee we will have collected all the data types on you laid out below. In the event we have to delete your data (such as requested by you) we will delete it safely and responsibly. We may choose to collect your data or stop collecting your data at any point during your usage of our website and services.

Who are we + important information

Privacy policy purposes:

The aim of this privacy policy is to give you information on how Change Your Luck collects then processes your personal data throughout the use of the website, including data that is provided when signing up for newsletters, purchasing products and services or taking part in a competition or prize draw.

THIS WEBSITE IS NOT INTENDED FOR ANYONE UNDER THE AGE OF 18. WE DO NOT KNOWINGLY COLLECT DATA ON CHILDREN. WE MAY BAN YOU PERMANENTLY FROM OUR CONTESTS IF IT IS DISCOVERED YOU HAVE ENTERED OR ATTEMPTED TO ENTER INTO A CONTEST WHILE BEING UNDER THE AGE OF 18, ENTERING ANYONE UNDER THE AGE OF 18, OR ENTERING ON THEIR BEHALF.

Reading this privacy policy is important and we ask that you do so, together with any other privacy policy or fair processing policy we MAY provide regarding specific instances and occasions when we collect and/or process data about you so you have full awareness of how and why your data is being used by us. This privacy policy is supplementary to other notices and privacy policies and is not intended to override them.

Controller -

The company “Change Your Luck LTD” is the controller. Change Your Luck LTD is therefore responsible for personal data stored by the company.. (In this policy, Change Your Luck LTD may be collectively referred to as “us”, “we”, “our” and “company”.)

The data privacy manager appointed by the company is responsible for overseeing questions in relation to this privacy policy. If you have questions regarding the privacy policy or requests to exercise your legal rights in regards to this policy, please use the contact information below to send your query.

Contact - Data Privacy Manager:

Questions and requests regarding this privacy policy should be directed to the contact details bellow or they may not be processable:

Legal Entities full name: Change Your Luck ltd

Email: contact.change.your.luck@gmail.com

Post address: 6 Margaret Street, Newry, County Down, United Kingdom, BT34 1DF

You may make a complaint at any time to the ICO (information commissioner's office) which is the UKs supervisory authority for data protection issues and can be found at www.ico.org.uk . In the instance of having a complaint, we would greatly appreciate contact being made with us so we may have a chance to resolve the issue before any escalation.

Changes to the privacy policy and your duty to inform us of changes to your information.

Our privacy policy is kept under regular review. This version was written and reviewed on 09 February 2025.

The personal data we hold in regard to you is important. It is important it is kept accurate and up to date. Please let us know if your personal data changes during our relationship with you.

Third-party links

This website may include links to third-party websites, applications, apps, and plug-ins. Clicking on or following these links and connections may allow third parties to collect data about you, which they may then share or process. We have no control of these third party websites and hold no responsibility for their privacy statements and what actions they take with your data. We encourage you to read the privacy policy of every website you visit when leaving our site.

Data we collect about you

Personal Data, also known as personal information, simply means any information about individuals that that person can then be identified from. It does not include anonymous data, which is data from which the identity has been removed.

We may collect, store, use and or transfer different sorts of personal data about you and which may have been grouped together as follows:

Identity data: Includes first name, last name, username and or similar
Contact data: Includes, Delivery address, billing address, email address and phone numbers (Mobile and or home)
Financial data: includes payment card details.
Transaction data: Includes data about payments to and from you. Includes details of products and services purchased from us by you.
Technical data: Includes IP (internet protocol) address, Browser type and version, log in data, location, time zone settings, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website.
Profile Data: includes your username and passwords. Includes purchases or orders made by you.
Usage Data: includes information about how you use our products, websites and services.
Marketing and communications Data: includes your communication preferences and your preferences in receiving marketing from us and our third parties.

Aggregated data will also be collected, used and shared for our purposes. This may be statistical or demographic. Aggregated data could be derived from personal data but it isn’t considered personal data, due to it being unable to identify you personally whether directly or indirectly.
Aggregated data example: Your usage data may be used to calculate how many people are using the websites about page, but the aggregated data example of “500 people accessed the website from https://www.changeyourluck.co.uk/ marketing system.” Does not identify any of the 500 individual people.
If we combine that aggregated data with personal data so that it can identify you (directly or indirectly) then this data is treated as personal data. This data will then be used in accordance with this privacy policy.

We are not interested in nor do we collect any Special Categories of Personal Data about our users or customers. These would be things like, Race/ethnicity, Religious or philosophical beliefs, sexual orientation, sex life or activity, Genetic or Biometric data, health, trade union membership or political opinions. Additionally we do not collect information regarding things like criminal convictions and offences.

To enable entry into a competition or prize draw we may collect the minimum amount of personal data that allows us to run the promotion. In the event you are named a winner it may be necessary for us to collect further, more detailed information from you so we may award you the prize. We will notify you of needing further information when we notify you of the win.

If you fail to provide personal data:

We may not be able to complete a contract with you if we need to collect personal data and you refuse to provide the requested Data (especially when we must do so by law, but also if the refusal violates the terms and conditions agreed to by entering the contest.) This may result in us being unable to provide the services, goods or prizes involved in the contract, or entry into a competition or draw. We will notify you if this is the case at the time.

How do we collect your personal data?

There are several collection methods, listed below:

Direct interaction - You give us your information, including Identity, financial, contact and Address information when filling in forms or when you send us the information by post/postal entry, or through other methods like phone email or other methods of communication. This includes the data provided by you when you:
Apply for our products and services.
Create an account with us
Subscribe to our services and publications
Request marketing (such as but not limited to newsletters and promotions)
Enter into a promotion, competition, survey or
When you give us feedback and or otherwise contact us

Automated technologies and or interactions-

as you use and interact with our website we will naturally collect data. This Technical Data would include such things as the equipment you are using as well as browsing patterns and actions. This information is collected by using cookies and similar technology. Review our cookie policy for further detail.

Third parties or publicly available sources. We may receive Personal Data about our users from various third parties, which is set out below:
Technical data from:
1) analytics providers based outside the EU (such as google)
2) advertising networks based outside the EU
3)contact and financial and transactional details from providers based within the EU

How your personal data is used by us

Your personal data is only used by us as allowed by law. Common uses of your personal data include the following circumstances -

Where we need to use your data to perform the contract we have or are about to enter into with you. A legally binding contract is formed between us (the company) and you (the customer) when you purchase goods or services and or when you enter into our prize draws or competitions.

Where we must comply with legal obligations.

Where the legitimate interest of us (the company) or our third parties would consider it necessary but where your fundamental rights and interests are not overridden.

Further information about lawful basis we rely on to use and process your personal data can be found below in the Glossary.

We do not Generally rely on consent as a legal basis for processing your personal data however we will have you give your direct consent before we send you direct third party marketing communications whether through text messages or emails. You retain the legal right to withdraw consent from this marketing at any time but must contact us to do so.

Scenarios/Purposes where we will use your personal data

Set out below is a description of all the ways we are currently planning to use your personal data, the legal bases we rely on for doing so and when appropriate also laid out our legitimate interests.

Please be aware that processing your Personal Data for one legal process does not mean that we will not process it for another legal process depending on the specific purposes for which your data is being used. For example if we process your data (financial) for you to buy tickets and enter a competition, to enter you into that competition we will have to process your data again to allocate you one or more tickets. This is required for us to fulfil the legal contract entered into when you purchased the ticket.

You can contact us for details about the specific legal grounds we are relying on to process your personal data, especially where we are using more than one ground as laid out below.

The purpose or activity

The type of Data

The Lawful basis we are relying on to process data, including the basis of legitimate interest

Registering you as a new customer

Identity data
Contact data

Fulfilling or performing our contract with you

Processing and delivering your order by

Managing payments, charges and fees.
Collect and or recover money owed to us

Identity data
Contact data
Financial data
Transaction data
Marketing and communications data

Fulfilling or performing our contract with you

In cases of our legitimate interests (such as recovering debts due to us)

To enable you to

partake in our prize draws and competitions
Complete a survey

Identity data
Contact data
Profile data
Usage data
Marketing and communications data

Fulfilling or performing our contract with you

In cases of our legitimate interests (learning how our customers use our products and services so we may develop these products and services and grow our business)

Managing our relationship with you which can include:
- asking you to take surveys or leave reviews.
-notifying you about changes to the websites terms and conditions or privacy policy

Identity data
Contact data
Marketing and communications data

To allow us to perform a contract with you
When necessary to comply with a legal obligation
In cases of our legitimate interests (keeping our records up to date and researching how our customers use our products and services)

When using data analytics, so we can improve our website, our products and services, and improve customer relationships, experiences and marketing.

Technical data
Usage data

In cases of our legitimate interests where we may
Define customer types for our products and services
Keep our website updated and relevant
Develop and inform our marketing and business strategy

Administrating and protecting the business and the business website (involving things like data analysis, troubleshooting, reporting and housing of data, support, system maintenance and testing)

Identity data
Contact data
Technical data

In cases of our legitimate interests or for running our business, the provision of administration and IT services. For the prevention of Fraud and ensuring network security, and in the case of business or group reorganisation or restructuring exercise.
When necessary to comply with a legal obligation

Suggesting and recommending goods and services that may be of interest to you

Identity data
Contact data
Profile data
Usage data
Marketing and communications data
Technical data

In cases of our legitimate interests
Developing and growing our products, business and services.

Delivering relevant advertisements and website content to you or when measuring and understanding the effectiveness of the advertising we serve to you

Identity data
Contact data
Profile data
Usage data
Marketing and communications data
Technical data

In cases of our legitimate interests
When learning how customers using our website, products or services to then develop these products and services and grow our business.
To inform and develop our market strategy

In the event you are the winner of the competition we may invite you to participate in publicity exercises relating to the won competition and future competitions. We may also invite you to publicity events involving promoting the company.
Participation in these events is not compulsory by law, but we would be greatly appreciative of your participation. Declining these publicity events does not affect your chances of winning future competitions.

In the event you do not wish to participate in our publicity events and decline to be publicly named the winner on our website, we may still have to provide your details to the ASA (advertising standards authority) to prove that the competition has been properly administered and the prize awarded to the appropriate party. This is a legal requirement that the company is bound to and with which we must comply. We may provide them with your details immediately at the competition's conclusion and award of the prize, or we may choose to do so at a later date, or upon request by the ASA. If you desire details of how the ASA will then use and process your personal data please contact the details laid out above.

Marketing:

We offer choices surrounding certain aspects of personal data usage, specifically concerning marketing and advertising.

Promotional offers we send you

Using Identity, contact, technical usage and profile data, we may form a view on what we think you may want, need or be of interest to you. This is the method we use to decide which products, services and offers may be relevant to your interests. (This is known as marketing.)

You will receive marketing communications from us if:

you have requested information from us
you have purchased goods or services from us
Entered a competition or prize draw
And if you have not opted out of receiving that marketing

Third-party marketing

We will get your express consent (opt in consent) before we share any of your personal data with third parties for marketing purposes.

Opting out

Opting out is available at any time. Whether from us or from third party advertising. To ask us or third parties to stop sending you marketing messages, click the links included in the relevant messages to opt out. You can also contact us at any time.

Opting out of marketing messages does not affect or apply to personal data you have provided to us as a result of using our services or buying our products. It does not affect warranty registration, product/service experience or other transactions. Opting out of marketing from ourselves or third parties does not affect win chances once you have entered competitions.

We understand not all users enjoy browser cookies. You can set your browser or firewalls to refuse all or some browser cookies or set them to alert you when a website sets or accesses cookies on your device. In the event you choose to disable or refuse cookies, please be aware that some parts of the website may become inaccessible or not function properly. For further information on our cookies, please see our cookie policy. https://www.changeyourluck.co.uk/cookie-policy=

Change of purpose in using your data

We will only use personal data for the purposes we have collected it for, unless it is considered reasonable by us that we need to use it for another reason and it is reasonable that that reason is compatible with the original purpose. For an explanation on how the changed purpose is compatible with the originally declared purpose, please contact us.

In the event the changed purpose of using your data is unrelated to the original purpose, we will notify you and explain the legal basis which allows us to do so.

Please be aware that we may process your personal data without either your knowledge or explicit consent in compliance with the privacy policy laid out above and below, or where it is required or permitted by law.

Disclosing your personal data

In the event we choose to share your personal data with the parties set out below, it will be for the reasons and to the people set out in the table above.

External third parties, as elaborated in the glossary
Third parties specified in the table above
The third parties involved in a sale in the event we choose to sell, transfer or merge parts of our businesses or assets to or with. In the event we choose to try acquiring other businesses or merging with other businesses then our business may change. If this change occurs then the new owners may use your personal data in the same way we have/had previously, as set out in this privacy policy.

All Third parties are required by us to respect the security of your personal data and treat it with respect in accordance with the law. We do not allow our third party service providers to use your personal data for their own purposes. We only permit them to process your personal data for purposes specified as relevant to their services and in accordance with our instructions,

International transfers.

Your data may be transferred to our partners outside the EEA, as this is where many third party service providers are based. Their processing of your data will require your data to be processed outside the EEA.

When your personal data is transferred out of the EEA by us, we ensure a similar degree of protection is afforded to it. We do this by ensuring at least one of the following safeguards is in place:

Your data is only transferred to countries that have been deemed by the European Commission to have an adequate level of protection for personal data. See the European Commission: Adequacy of the protection of personal data in non EU countries, for further details.
Where certain service providers are used by us, we may use specific contracts as approved by the EC (European Commission) that give personal data the protections it has in Europe. Further details at: European Commission: Model contracts for the transfer of personal data to third countries.
The European Commission: EU-US Privacy Shield can require US based service providers to provide similar protections to personal data that personal data receives in Europe. When we use providers based in the US, we will ensure they are part of this privacy shield.

Please contact us using the information laid out above if you wish for further information on specific mechanisms used by us when transferring your Personal Data outside the EEA.

Data Security

Appropriate security measures have been put in place to prevent your personal data from being used or accessed in unauthorised manners, to prevent loss and to prevent it being altered or disclosed inappropriately. Additionally, we have limited who has access to your personal data internally to those employees, agents and contractors or third parties who have a business need to know. They will only process your personal data when instructed to do so by us and they are subject to a duty of confidentiality.

We have procedures in place to deal with any suspected Personal Data breaches and will notify you and any applicable regulators of a data breach where we are legally required to give notification.

Data retention period

Length of time we use your personal data.

We retain your personal data only for as long as is reasonably necessary to fulfil the purposes it has been collected for. This includes the purposes of satisfying any form of legal, tax, regulatory, accounting or reporting requirements. We may retain your personal data for longer periods of time if there is a complaint, or in the case we reasonably believe there is a chance of litigation in respect to our relationship to you.

We determine the appropriate retention period for your data by considering the amount of data as well as its nature and the sensitivity of the personal data. We assess the potential risk of harm that may arise from the unauthorised disclosure or use of your data. We assess the purposes we process your personal data for to determine if we can achieve these purposes in another manner. We keep in mind the legal, regulatory, accounting, tax and other requirements that apply to us during these assessments and the use of your data.

You may request our retention policy from us if you require further details. This is available on request. Please note we have a response time of up to one month.

See “Your legal rights” For further information of circumstances where you may request the deletion of your legal data.

We may use your information indefinitely when it has been anonymised (Meaning it can no longer be associated with or to you) for research and statistical purposes.

Your legal rights

Under data protection laws you have rights under some circumstances in relation to your personal data.

Please contact us to exercise these rights. We normally do not charge a fee for you to access your personal data, or exercise your legal rights.
We may refuse to comply with your request or we may charge a reasonable fee in the case your request(s) are clearly unreasonable, repetitive or are found to be excessive.

In the event we need something from you:

Before giving out personal data, we will request information from you to confirm your identity and your rights to access your personal data and exercise other rights. We do this to ensure the person requesting the data has the legal right to view that data and to avoid security breaches, unauthorised data access and incorrect distribution of information. We may occasionally contact you for further information or clarification in relation to your request so we may respond faster.

Response timeline

We strive to respond to legitimate requests for data within one month. In the event your response is particularly complex, multiple requests have been made or we are experiencing unusual levels of activity, it may take us longer to respond. We will notify you at that time once we think there will be a delay, and keep you updated.

Legal glossary
Glossary

Lawful basis

Comply with legal obligation - this is processing your personal (and other) data where and when necessary to comply with any legal obligations we are subject to. This may include but is not limited to retaining your data as a winner so it can be reported to the ASA.

Performance of contract - this is processing your data (personal and otherwise) where it is necessary for us to complete our end of a contract we have made with you. This may include but is not limited to such things as processing your data to assign you a ticket number.

Legitimate interest - This means the interests of our business or business partners. It regards conducting and managing our business operations to enable us to give the best services and products, as well as provide the most secure experience. We consider and balance any impacts our operations might have on you (positive or negative effects) and your rights before the processing of any of your personal data for our Legitimate interests takes place. Your personal data is not used where using your data for our interests would be overridden by the impact on you, unless we are permitted by law or have your consent. Contact us for further information on how we assess our interests against their impact on you by contacting us.

Third parties and their involvement

External third parties:

Professional advisors - these are people acting as processors and include but are not limited to lawyers, bankers, auditors, and insurers. Based in the UK and provide services like consultancies, banking, legal advice, insurance services and accounting services.
Service providers - processors based in the USA and Europe. Providing IT, system administration and website hosting services.
HM Revenue and Customs, Advertising Standards Authority and other regulatory authorities, as well as other authorities who act as processors and are based in the UK who, under certain circumstances, require the reporting of processes and processing activities.

Your legal rights

You have rights to:

Request a “data subject access request”. This is a request to access your personal data and enables you to receive a copy of the personal data we hold about you and to check that we are processing it in a lawful manner.

Request that we correct any of the personal data that we hold about you. This allows you to have incomplete or inaccurate data about you corrected, but we may have to verify that the new information you provide about yourself is accurate.

Request the erasure of your personal data. This enables you to request the deletion or removal of personal data on or about you that is held by us when there is no good reason for us continuing processing it. You also have rights to request removal or deletion of your personal data if you have successfully exercised your right to object to processing (detailed below) where it has been shown we may have processed your data/information unlawfully or where the erasure of your personal data is required to comply with local law. Please note that we are not always able to comply with your request of erasure for specific legal reasons and that these will be notified to you at the time of your request if they are applicable.

Object to the processing of your personal data where we are relying on a legitimate interest of us, or a third parties legitimate interests, and there is something about your situation which you want to use to object to the processing of your information, as you feel that the ground you want to use impacts your fundamental rights and freedoms. Additionally where we are processing your personal data for direct marketing purposes you have the right to object. We may demonstrate in some cases that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Request that processing of your personal data be restricted. This enables you to ask us to suspend the processing of your personal data in the following circumstances and scenarios:

Establishing the data’s accuracy, possibly under your request.
Where use of your data is unlawful but you do not want it removed, erased or deleted.
Where you need us to hold on to the data as you need it for establishing, exercising or defending legal claims, even if we no longer require it. (Note, if requests for this data come in AFTER it has already been deleted, we can not recover it, even under these circumstances)
You have objected (and made these objections known to us) our use of your data, but we still have need of it to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your personal data to you or to another third party. In the event of this request we will provide you or your chosen third party your personal data in a structured, common, machine readable format. Note: this right only applies to automated information, where you initially provided us consent to use the information or where we used the information to perform a contract with you.

Withdraw consent. At any time you can withdraw your consent to processing your personal data, where we are relying on your consent to process that personal data. This will not however affect the lawfulness of any processing we carried out before your consent was withdrawn. If you withdraw your consent then after that point we may not be able to provide certain products or services to you. If this is the case at the time of your withdrawal of consent, we will advise you of this.

Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.