World Cup Sweepstake

Privacy Policy

Last updated: 11 June 2026

This privacy policy explains how Black Pastel collects, uses and protects personal information through the World Cup Sweepstake platform.

Who is responsible for your information?

Black Pastel operates this platform and is the data controller for organiser accounts, support enquiries and platform administration. You can contact us at hello@blackpastel.co.uk.

An organiser who uploads entrant names, photographs or other information is also responsible for making sure they have a lawful reason and appropriate permission to provide and publish that information.

Information we may collect

Organiser name, email address, login details and account activity.
Sweepstake names, settings, access codes, entrants, teams, prizes and draw information.
Entrant names, display names, photographs and organiser notes.
Password-reset requests, security records and essential session information.
Support emails and information supplied when contacting Black Pastel.
Technical information such as IP address, browser information, timestamps and server logs.
Limited payment information supplied to us by Stripe, such as payment status, amount and transaction reference.

Card details are entered directly into Stripe’s secure checkout and are not stored by this website.

How we use personal information

To create and administer organiser accounts and sweepstakes.
To display public sweepstake pages requested by organisers.
To provide login, password-reset, support and security functions.
To process and record voluntary project-support payments.
To prevent abuse, investigate faults and maintain platform security.
To comply with legal, regulatory, accounting or fraud-prevention obligations.

Our lawful bases

Depending on the activity, we rely on performance of a contract or steps requested before entering a contract, legitimate interests in operating and securing the platform, compliance with legal obligations, and consent where consent is the appropriate lawful basis.

Public sweepstake information

Sweepstake pages may be accessible to anyone who has the public link or access code. Entrant names, photographs, assigned teams and prize information may therefore be visible publicly. Organisers should only upload information they are authorised to use and should remove it when it is no longer appropriate.

Who we share information with

We may share relevant information with:

Website hosting, email, database and security service providers.
Stripe, which processes voluntary support payments.
Professional advisers, regulators, courts or law-enforcement bodies where required.
A replacement service provider or business owner if the platform is transferred, subject to appropriate safeguards.

International transfers

Some service providers may process information outside the United Kingdom. Where this happens, we expect appropriate legal transfer mechanisms and safeguards to be used.

How long we keep information

We keep information only for as long as reasonably necessary for the purpose for which it was collected, including operating the relevant sweepstake, providing support, maintaining security records and meeting legal or accounting obligations. Organisers may ask us to close their account or remove a sweepstake.

Security

We use measures such as password hashing, restricted organiser and administrator access, expiring password-reset tokens, HTTPS and secure hosted payment checkout. No online service can guarantee absolute security.

Your data protection rights

Depending on the circumstances, you may have rights to access, correct, erase, restrict or object to the use of your personal information, and to receive a copy of information you provided. You may also withdraw consent where processing relies on consent.

To exercise a right, email hello@blackpastel.co.uk. We may need to verify your identity.

Complaints

Please contact us first so we can try to resolve your concern. You also have the right to complain to the UK Information Commissioner’s Office.

Changes to this policy

We may update this policy when the platform, service providers or legal requirements change. The latest version will always be published on this page.

This policy is intended to describe the platform as currently configured. It should be reviewed if analytics, advertising, new payment systems or additional personal-data features are introduced.