Version: 2026-10-19. Published and effective: 19 October 2026.
1. Operator and privacy contact
1.1 TagNWin is operated by C.K.C Private Security Services LTD, Cyprus, VAT CY10374763W. Contact address: Kyriakou Matsi 23, Kariatis 8 Building, 1st Floor, Office 101-102, Agioi Omologites, Nicosia 1082, Cyprus. Contact privacy@tagnwin.com for data protection, support@tagnwin.com for account assistance and billing@tagnwin.com for billing enquiries.
1.2 C.K.C Private Security Services LTD is the controller for the TagNWin processing described in this Policy. Contact our privacy team using the email or postal address above. A participating Business is responsible for its own handling of personal information for its fulfilment, employment and other independent purposes.
2. Individuals covered and sources
2.1 This Policy concerns natural persons connected with a Business: Owners, Managers, Staff, sole traders, representatives, billing/sales contacts and support correspondents. Information about a company is personal data where it identifies or relates to an individual. Members should read the separate Member Privacy Policy; the Business's handling of Winner data also requires the safeguards in section 8.
2.2 We obtain information directly from you, from a Business administrator inviting or managing you, from use of the platform, payment/communications providers and relevant verification sources. The Business should give invited users this notice; each user must have access to the applicable information regardless of who supplied their details.
3. Identity, team and Store information
3.1 Business records include legal/trading name, registration and VAT identity, registered address, country, contact details and verification evidence. User records include name/contact details, verified work email, role, invitation/account state, access events and acceptance records. Store location, contact details and operating information may identify a sole trader or named employee.
3.2 Role changes, ownership recovery, content edits, publication, support access, Winner-contact views and delivery actions can create actor/time/reason and audit records. Those records support accountable business operation; they are not a promise that all employee activity is measured or that every user can inspect every other user.
4. Subscriptions, payments and verification
4.1 We process the selected plan, Store band, paid cover, invoice/credit-note references, payment status and billing correspondence to administer subscriptions and obligations. VAT verification and associated evidence support tax treatment. Payment details are supplied through the payment provider’s checkout and invoice functions, which identify the provider and its privacy information. TagNWin receives the transaction and billing information needed to manage the subscription. Do not send full card details or authentication secrets to support.
5. Content, AI requests and support
5.1 Competition text, images, logos, Prize information and authored collection notes may contain personal data. Image-generation requests can include the prompt and uploaded material, together with provider/model, time, acting user, moderation and approval evidence. Avoid including unnecessary personal information or identification documents in content or prompts.
5.2 Support requests, reports, disputes and investigations may include correspondence, evidence, relevant account events and decisions. Provide only what is necessary. When you use an optional AI feature, the relevant prompt and supplied material are processed to provide the requested output and assess safety or rights issues. Do not submit confidential or personal information that is unnecessary for the requested artwork.
6. Purposes and legal bases
6.1 Where you are personally the contracting party, we process necessary account, service, subscription and support information to perform that contract or take requested pre-contract steps. For employees and other Business contacts, we rely on legitimate interests in administering the Business relationship, permissions, communications, publication and fulfilment, balanced against individual rights. We also rely on legitimate interests for proportionate security, fraud prevention, service administration and establishing or defending claims. Applicable accounting, tax, court and regulatory duties provide the basis where the law requires processing.
6.2 Service communications about invoices, account security, Competitions and fulfilment are distinct from optional marketing. Accepting Business Terms or acknowledging this Policy is not blanket marketing consent. Any later optional marketing or other consent-based use needs the appropriate separate choice and withdrawal process.
6.3 Required identity, contact, role and billing information is necessary for the relevant registration, permissions, payment or legal obligation; without it the corresponding service may be unavailable. Optional content and feature inputs are required only if you choose that feature. You can withdraw consent where used without affecting earlier lawful processing. You may object to legitimate-interest processing as described in section 12.
7. Access within the Business and TagNWin
7.1 Business roles determine permitted management and fulfilment functions. Named actions may be visible in appropriate operational/audit views. Invitations and role changes are administered through the product's permission model. Contact your Business administrator about employment/role matters and TagNWin about its own processing.
7.2 Platform support access uses the time-limited impersonation process, a recorded reason, sensitive-read/write audit and Business notice. That access is for authorised support purposes; it does not create a right to use employee or Winner data for unrelated activities.
8. Winner data and fulfilment exports
8.1 The platform makes the permitted confirmed Winner information available to authorised fulfilment users, with logged access. It does not provide non-winner lists, home addresses or home pins. The Business must use the information solely to arrange and evidence fulfilment and must not add Winners to marketing lists.
8.2 The Competition-scoped Winner/Delivery CSV excludes Claim Codes, addresses, reserves and non-winners. Contact access closes with the relevant assignment. Downloaded files are outside the platform's immediate access controls: the Business must restrict access, secure copies and apply the approved retention/deletion process. The absence of an automatic deletion feature does not discharge legal obligations.
8.3 TagNWin is responsible for its platform processing and disclosure. The Business is responsible for its own fulfilment records, exported copies and related legal duties as controller for those purposes. It must provide appropriate information to affected people, identify a lawful basis, respond to rights requests and notify TagNWin promptly of a relevant data incident. Where a particular service instead involves processing solely on another controller’s instructions, a separate appropriate data-processing agreement is required; this Policy is not such an agreement.
9. Service providers and other recipients
9.1 Information may be handled by authorised personnel and contracted providers for hosting, storage/backups, payments, communications, authentication, maps, image generation and security, to the extent needed for the service used. Professional advisers, courts and authorities may receive necessary information for justified claims or legal obligations. Providers acting on our instructions are subject to applicable data-processing and confidentiality requirements; providers acting for their own lawful purposes give their own privacy information. Cloudflare supplies public website hosting and network/security services under section 13.
10. Processing locations and transfers
10.1 Service providers and their support operations may process information in the EEA and other countries; Cloudflare operates a global network. Where a transfer outside the EEA requires safeguards, we use an applicable European Commission adequacy decision or appropriate safeguards, such as the Commission’s standard contractual clauses with any necessary supplementary measures. You may request information about the recipients, relevant countries and applicable safeguards, or a copy of the safeguards subject to necessary confidentiality redactions, from privacy@tagnwin.com. We do not represent all processing as EU-only.
11. Retention and departing Businesses
11.1 We retain identifiable information only while needed for the relevant service, legal or evidential purpose. Account, role and contact records support the active Business relationship and necessary offboarding. Subscription, invoice and VAT records follow applicable accounting/tax retention requirements and claim periods. Competition, Draw and handover evidence remains while needed to complete published obligations and resolve related claims. Content, prompts and provenance are kept for the requested output, moderation, authorised publication and justified rights disputes; unnecessary inputs should be deleted when those purposes end.
11.2 Cancellation, inactivity or removal of a user does not automatically erase every record. Existing Prize obligations and legitimate legal retention need separate handling. Contact privacy@tagnwin.com for rights requests and support@tagnwin.com for operational offboarding; a generic self-service export packet is not promised.
11.3 Support, security and audit records remain while needed to resolve the relevant issue, protect the service or meet a specific legal hold. Exported Winner data must not outlive the fulfilment, statutory or justified claim purpose. Recovery backups expire through their applicable cycle and are not used for unrelated purposes; deletion instructions are reapplied after restoration. When retention is no longer justified, information is deleted or irreversibly anonymised. Pseudonymised information remains personal data. Ask privacy@tagnwin.com about the criteria for a specific record.
12. Individual rights, requests and complaints
12.1 Subject to applicable conditions, individuals may request access, correction, erasure, restriction or portability, object to legitimate-interest processing and withdraw consent where relevant. Rights belong to individuals and are distinct from the company's contractual rights. A Business cannot waive a user's statutory data-protection rights through these Terms or this Policy.
12.2 Send requests to privacy@tagnwin.com. Proportionate identity checks may be needed; any lawful restriction/refusal will be explained. GDPR requests must be addressed without undue delay, normally within one month, with any permitted extension of up to two further months notified and explained within the first month. This does not promise instant deletion of records that must lawfully be retained.
12.3 Individuals may complain to a competent supervisory authority, including where they habitually reside, work or allege an infringement. Relevant authorities include Cyprus's Commissioner for Personal Data Protection and Greece's Hellenic Data Protection Authority. An internal complaint is not a prerequisite.
12.4 Automated rules can check subscription cover, permissions and publication prerequisites and restrict an action when its requirements are not met. You may ask support@tagnwin.com to explain or review a disputed restriction and submit relevant information. This does not limit rights to human intervention or to contest a decision where data-protection law requires them.
13. Website technologies and traffic monitoring
13.1 The public website is hosted on Cloudflare Workers. We use Cloudflare’s aggregate HTTP and Worker metrics to monitor traffic, performance and security. This does not add a browser analytics beacon, advertising pixel, session replay, tracking identifier or optional analytics cookie. Fonts and illustrations are hosted with the site; language preference is carried in the URL rather than browser storage.
13.2 Cloudflare processes technical request data, including IP addresses, requested URLs, timestamps and browser/network information, to deliver and protect the website and produce operational metrics. Aggregate reports do not mean that all underlying network data is anonymous. We rely on our legitimate interests in providing a reliable, secure website and understanding its use. Website Worker application logs and traces are disabled. Cloudflare’s necessary network and security records follow the applicable service retention settings and incident requirements. See the website’s Cookies & technology notice for details; contact privacy@tagnwin.com for information about processing and your rights.
14. Changes and language
14.1 We maintain identifiable Policy versions and provide appropriate notice of material changes. A new purpose requiring a different basis or consent must be assessed and communicated; editing this document does not itself authorise processing. Greek and English section numbering and meaning are intended to match.