Privacy Policy

Full-site service notice: sign-in uses Google OAuth, Resend verification emails or an optional account password set after email verification, with account, session, entry and transaction records stored for operating the service. Paid entries and Stripe payments are available only for drops whose entry controls show them as open, and external draws follow the published drop method after entries close. Sentry may receive privacy-filtered technical error diagnostics, with Sentry session replay disabled. GA4, Meta and Contentsquare run only for the consent categories you choose and only when those services are enabled.

1. Introduction

TNCollectors LTD, trading as The New Collectors (“we”, “us”, “our”), is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website at https://thenewcollectors.com/ or enter one of our prize competitions.

This Privacy Policy is issued in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using our website or entering a Competition, you confirm that you have read and understood this Privacy Policy.

2. Who We Are

TNCollectors LTD, trading as The New Collectors, is the data controller responsible for your personal data.

Company number: 17306539

Registered address: 124 City Road, London, United Kingdom, EC1V 2NX

Email: contact@thenewcollectors.com

Our website now provides public competition information and optional account sign-in. Users may submit paid entries, make payments or take part in a draw only when the corresponding drop and launch controls show those functions as open and the applicable details and terms are published.

3. Personal Data We Collect

We collect and process the following categories of personal data:

3.1 Information you give us:

• Full name
• Email address

18+ age declaration

• Country of residence
• Postal address (for prize delivery and verification)
• Telephone number (if provided)
• Payment information (processed securely by our payment provider — see section 6)
• Skill question answers
• Any other information you provide via contact forms, customer support, or correspondence

If you joined our pre-launch waitlist, we retain the email address, consent version and subscription status under the retention terms below. Full-site accounts are separate and use Google OAuth or Resend email links.

For people who submitted the pre-launch waitlist form, we kept a private submission record to diagnose signup problems. It contains the submitted email address, submission time, consent and policy version, and request outcome. Those records remain subject to the original 30-day cleanup and unsubscribe/expiry deletion rules, are visible only to authorised operators, and are not sent to Google Analytics or Meta.

3.2 Information we collect automatically:

• IP address
• Browser type and version
• Device type, operating system, and screen resolution
• Pages visited, time spent, and navigation behaviour
• Referring website
• Cookie data (see section 8)

If you consent to Marketing tracking, Meta Pixel and Conversions API receive page views and interactions (Instagram clicks, form opening, submission attempts and error categories), browser and device information, IP address and cookie identifiers for advertising measurement. For new waitlist subscribers we also send a server-verified Lead and a normalized SHA-256 hash of the email address to help Meta match the conversion. A hash is not anonymous: Meta may match it to an account. We do not send the raw email address or other form contents to Meta.

Where you give separate Session recording consent, Contentsquare may collect page views, clicks or taps, scrolling and mouse movements to create heatmaps and reconstruct your interaction with public pages. Public page text, numbers and media may be visible in these replays because website-level masking is set to No masking. Contentsquare’s automatic personal-data redaction remains active. Account, authentication, administration, cart, checkout and diagnostic routes are excluded from recording, and sensitive form fields require additional code-level protection. We do not use Contentsquare Identify or connect a recording to your email address. You can withdraw Session recording consent at any time through Cookie settings to stop future collection.

3.3 Information from winners (additional):

If you win a Competition, we will also collect:

• A copy of your government-issued photo ID (passport, driving licence, or national ID card)
• Proof of the payment method used to enter
• Confirmed delivery address
• Photographs or videos (only if you give explicit consent)

Photo ID is considered special category data under UK GDPR. We collect it solely for identity verification and anti-fraud purposes, and only from winners.

4. How We Collect Your Data

We collect your personal data when you:

• Create an account on our website

Enter a Competition as a guest or registered user; the entry flow creates or links an account for the entry record

• Subscribe to our newsletter or marketing communications

Create or use an account

• Contact us via email, contact form, or social media
• Win a Competition and provide verification documents
• Browse our website (via cookies and similar technologies)

5. How We Use Your Data and Our Lawful Bases

Under UK GDPR, we must have a lawful basis to process your personal data. We process your data for the following purposes and on the following lawful bases:

Processing your Competition entry and taking payment — performance of a contract with you.

Verifying your eligibility (age, residence, identity) and preventing fraud — our legitimate interests in running a fair and lawful competition.

Selecting winners and delivering prizes — performance of a contract with you.

Verifying winners’ identity using photo ID — substantial public interest in fraud prevention, as permitted under the Data Protection Act 2018.

Sending marketing emails about future Competitions — your consent, or the soft opt-in permitted under PECR where you have previously entered a Competition.

Running social media retargeting advertising — your consent, collected via our cookie banner.

Analysing use of the website through Google Analytics 4, and using Contentsquare heatmaps or session recordings to improve the website — your consent, collected through our cookie settings.

Operating your account and sending authentication or service messages — performance of our service agreement with you. Marketing messages remain subject to a separate consent or another lawful basis permitted by PECR.

Complying with legal, tax, and accounting obligations — legal obligation.

Responding to your questions or complaints — our legitimate interests in customer service.

Publishing winner details (first name and country) — our legitimate interests in promoting the Competition and complying with applicable advertising standards.

You may withdraw consent at any time where consent is the lawful basis — see section 11.

6. Who We Share Your Data With

We do not sell your personal data. We share it only with the following categories of recipients, and only as necessary:

6.1 Service providers:

Website hosting: Google Firebase App Hosting — hosts and delivers the website

Database and file storage: Supabase — stores account, competition, entry and operational records and approved media when those functions are used

Email delivery: Resend — sends sign-in links and approved transactional or consented marketing messages

Tag management and analytics: Google Tag Manager and Google Analytics 4 — load approved measurement tags and measure website usage, only with the applicable consent

Session recording and heatmaps: Contentsquare — helps us understand eligible public pages only with separate Session recording consent; account, authentication, administration, cart, checkout and diagnostic routes are excluded

Social media advertising: Meta — with separate Marketing tracking consent, Meta Pixel measures eligible public page, product and checkout interactions. After Stripe confirms payment, our server sends Meta a Purchase event through the Conversions API only when valid Marketing consent was recorded for that Checkout Session. The event includes the drop and paid amount; matching uses normalized SHA-256 hashes of the purchaser’s email and, when available, phone number and name, plus validated first-party Meta browser/click cookies captured at checkout. Raw contact details are not sent. Email-update consent is separate from Marketing tracking consent. Automatic advanced matching and automatic event collection remain disabled. Meta’s processing is described in its Privacy Policy at https://www.facebook.com/privacy/policy/.

Professional advisers: accountants, lawyers, and auditors as required

6.2 Public disclosure:

During the live broadcast of the draw, we publicly announce the winner’s first name and country of residence. The winner’s first name and country will also be made available to any entrant on written request for one month following the draw, as required by applicable advertising standards.

6.3 Legal disclosure:

We may share your data where required by law, court order, or regulatory request — including in connection with fraud prevention, anti-money laundering, or tax compliance.

6.4 Business transfers:

If we sell, transfer, or merge parts of our business, your personal data may be transferred as part of that transaction. Where this occurs we will take reasonable steps to ensure your personal data continues to be protected to the standards set out in this Privacy Policy.

7. International Transfers

Some of our service providers are based outside the United Kingdom. Where we transfer your personal data outside the UK, we ensure appropriate safeguards are in place:

Our Supabase project is hosted in London. Resend routes and sends email from Ireland, while its account data, email metadata, logs, API records and message content are stored in the United States. Google, Meta and Contentsquare may also process data internationally, depending on the service used.

EU/EEA countries: transfers are protected by the UK’s adequacy decisions for the European Economic Area.

United States: transfers to US-based providers (e.g., Google, Meta) are protected by the UK Extension to the EU–US Data Privacy Framework where the recipient is certified, or by the International Data Transfer Agreement (IDTA) / UK Addendum to the EU Standard Contractual Clauses.

Other countries: transfers are protected by the IDTA, UK Addendum to SCCs, or other appropriate safeguards under UK GDPR.

You may request further information about these safeguards by contacting us at contact@thenewcollectors.com.

8. Cookies

Our website uses cookies and similar technologies. For full details about which cookies we use, why, and how you can control them, please see our separate Cookie Policy at https://thenewcollectors.com/cookies.

In summary, we use:

• Strictly necessary cookies — required for the website to function (no consent required)
• Analytics cookies — Google Analytics 4 (used only with your consent)
• Marketing cookies — Meta Pixel for retargeting (used only with your consent)

Session-recording technologies — Contentsquare heatmaps and session recordings, used only with separate consent on eligible public pages; private and sensitive routes are excluded

Analytics, marketing and session-recording technologies do not load until you give the corresponding consent and the service is enabled. You can withdraw consent at any time through Cookie Settings.

You can manage your cookie preferences at any time via the cookie banner on our website.

9. How Long We Keep Your Data

We keep your personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law. The factors we consider when determining retention periods include the nature of the data, the purpose for which it was collected, any legal or regulatory obligations to retain it, and any applicable limitation periods for legal claims.

For the full-site service, the following retention schedule applies unless a longer period is required by law or a legal, tax, chargeback or fraud hold applies:

Account and contact data: delete or anonymise after 24 months of inactivity unless linked to a paid transaction or legal hold.

Transaction, entry, payment and accounting evidence: retain for 6 years, or longer if legally required.

Audit and draw records: retain for 6 years.

Confirmation email metadata: retain for 6 years; support messages: retain for 24 months after resolution.

Routine security and Sentry logs: retain for 90 days; security incidents: retain for 12 months after resolution.

Winner identity, payment proof and delivery evidence: retain for 90 days after delivery or claim closure.

Legal, tax, chargeback or fraud holds: retain until resolved, then apply the normal schedule.

We review this retention schedule quarterly.

We retain legacy coming-soon waitlist records until you unsubscribe or for 24 months after the last recorded activity, whichever occurs first. Repeating an already-active signup does not extend that period. After unsubscribe or expiry, the email address is removed from the active Supabase waitlist record and we retain limited suppression and consent evidence to respect your choice. Resend may retain the email address with an opted-out subscription status as suppression evidence; it is not an active launch subscriber. Short-lived abuse-prevention counters use an email hash rather than the email address or raw IP address and are removed after 24 hours. Google Analytics 4 user-level and event-level data retention is set to two months; this setting does not determine the lifetime of all aggregated reports or cookies. Contentsquare operates only with separate Session recording consent, with public page content visible and private or sensitive routes excluded as explained in section 3.2. Our Free subscription provides one month of analytics and replay access. Its automatic 15-day Growth trial may temporarily provide 13 months of analytics access and two months of replay access before returning to Free. Contentsquare states that replay data is deleted after one month by default, with longer periods available depending on the plan, IP addresses after three days, and other analytics data may be retained for up to 13 months under its standard policy (https://contentsquare.com/privacy-center/frequently-asked-questions/). We do not export replays or link recordings to account email addresses. Meta Pixel operates only with Marketing consent. Meta’s cookie lifetimes are listed in our Cookie Policy and are separate from retention of information already received by Meta, which is governed by its applicable terms and Privacy Policy. Pending conversion matching payloads are retained for up to 24 hours and cleared after delivery, failure, expiry or recorded withdrawal. A random first-party marketing identifier (tnc_meta_session, up to 90 days) links pending delivery to your withdrawal request. Minimal delivery identifiers prevent duplicate processing; withdrawal identifiers expire after 90 days. Withdrawing consent stops future collection through our Pixel and Conversions API and cancels pending events where the withdrawal has been recorded but does not itself delete information already received by Meta; you may exercise your rights using Meta’s privacy controls or contact us for assistance.

After the relevant retention period, we securely delete or anonymise your data. You may contact us at contact@thenewcollectors.com to request further information about the retention periods that apply to your data.

10. How We Protect Your Data

We take reasonable technical and organisational measures to protect your data, including:

• SSL/TLS encryption for all data transmitted to and from our website

Account passwords, when set after email verification, use industry-standard hashing; Google OAuth and email verification links remain available.

• Restricted access to personal data on a need-to-know basis
• Use of reputable third-party providers with their own security measures
• Payment information is processed directly by our payment provider and is not stored on our servers

No system is 100% secure. If we become aware of a data breach affecting your rights, we will notify you and the ICO in accordance with our obligations under UK GDPR.

11. Your Rights

Under UK GDPR you have the following rights:

• Right of access — to obtain a copy of the personal data we hold about you
• Right to rectification — to ask us to correct inaccurate or incomplete data
• Right to erasure (“right to be forgotten”) — to ask us to delete your data in certain circumstances
• Right to restriction — to ask us to limit our processing of your data
• Right to data portability — to receive your data in a portable format
• Right to object — to object to processing based on legitimate interests, including direct marketing
• Right to withdraw consent — where we rely on consent as the lawful basis
• Right to complain — to the Information Commissioner’s Office (see section 15)

To exercise any of these rights, contact us at contact@thenewcollectors.com. We will respond within one month (extendable by two further months for complex requests).

We may need to verify your identity before responding to a rights request.

12. Automated Decision-Making

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on you. Winners are selected by random draw, which is not automated decision-making within the meaning of UK GDPR Article 22.

13. Marketing Communications

If you have consented to receive marketing, or if you have entered a Competition and we have a soft opt-in basis under PECR, we will send you marketing emails about future Competitions, prizes, and related content.

People who joined the pre-launch waitlist gave explicit single opt-in consent for Drop 001 launch news and occasional collector updates. That consent remains separate from an account and can be withdrawn at any time.

You can opt out at any time by:

• Clicking the “unsubscribe” link in any marketing email

Contacting us to update your marketing preferences

• Emailing us at contact@thenewcollectors.com

Opting out of marketing will not affect any transactional or service-related emails (e.g., entry confirmations, winner notifications).

14. Children

Our Competitions are strictly for entrants aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we may have inadvertently collected such data, please contact us immediately and we will delete it.

15. Complaints

If you have a concern about how we handle your personal data, please contact us first at contact@thenewcollectors.com — we will do our best to resolve your concern.

You also have the right to lodge a complaint with the Information Commissioner’s Office:

Website: ico.org.uk

Telephone: 0303 123 1113

Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our practices, or our service providers. Any updates will be published on this page with a revised “Last updated” date. We encourage you to review this page periodically to stay informed of any changes.

17. Contact Us

For any questions about this Privacy Policy or how we process your personal data:

Email: contact@thenewcollectors.com

Postal address: 124 City Road, London, United Kingdom, EC1V 2NX