Version: 2026-10-19. Published and effective: 19 October 2026.
1. Who is responsible and how to contact us
1.1 TagNWin is operated by C.K.C Private Security Services LTD, Cyprus, VAT CY10374763W. Contact address: Kyriakou Matsi 23, Kariatis 8 Building, 1st Floor, Office 101-102, Agioi Omologites, Nicosia 1082, Cyprus. Privacy enquiries: privacy@tagnwin.com. Account and claim support: support@tagnwin.com.
1.2 C.K.C Private Security Services LTD is the controller for the TagNWin processing described in this Policy. Contact our privacy team using the email or postal address above. A participating Business is responsible for its own handling of personal information for its fulfilment, employment and other independent purposes.
2. People and services covered
2.1 This Policy covers Members and, where relevant, people acting as their collection representatives, people contacting support and visitors to Member-facing website pages. Business owners and staff should also read the separate Business Privacy Policy. A fulfilling Business receives only the permitted information described below; it does not receive general access to Member accounts.
2.2 We obtain information from you, your interactions with the service, permitted device signals, the fulfilling Business's handover records, communications providers and people reporting an issue. Where a representative's information is recorded by a Business, the required notice must be available to that representative at collection.
3. Account and communication information
3.1 Account information includes full name, verified mobile number, email and its verification status, structured home address, an age-18-or-over declaration, account state and Terms acceptance version/time/locale. Registration asks for an adult declaration, not routine submission of an identity-document image. Contact updates, recovery requests and security events may create associated records.
3.2 We process support correspondence and delivery status for service messages, including verification, security, Winner and deadline communications. Required account information supports the relevant account functions; failure to provide or maintain it can prevent registration, verification or reliable notification. Unverified email alone does not exclude a Member from a Draw.
4. Home pin, Scan location and device information
4.1 Your home pin is optional and is saved only after you confirm or place it. The saved pin is reduced to approximately three decimal places, roughly 100 metres. It supports radius-based residence eligibility at Competition end. Without it, radius-based residence Entries are unavailable, but country-wide Entries and qualifying Store Scans remain possible. It is not shared with Businesses or used as a collection address.
4.2 In-app Scans require location permission to check physical Store presence. The service records Scan outcomes, relevant timestamps, device/install and operating-system integrity information and associated security evidence. Live location does not replace the home pin for residence eligibility. OS-sanctioned integrity signals are intended for abuse prevention; these signals must not be used for cross-app tracking.
5. Entries, Draws and fulfilment records
5.1 Records include valid Entries and their source, fixed Draw pools and verification evidence, rankings/results, reserve and award history, notification evidence, individual claim deadlines and delivery/dispute outcomes. A Claim Code is confidential fulfilment information; it should not be posted publicly.
5.2 Handover records identify the acting Business user, document type and verified-name check. A document number and handover photo are optional. The handover process must not store an identity-document image or home address. Representative collection uses the representative's own identification. Receipt may be recorded by your authenticated delivery-confirmation Scan or the permitted manual Store process.
6. Purposes and legal bases
6.1 We process information necessary to perform our agreement with you: creating and maintaining your account, providing support, applying published eligibility rules, recording Entries, selecting and notifying Winners, and arranging Prize fulfilment. This includes the limited disclosure to the fulfilling Business needed to provide a notified Prize. Optional features require only the information necessary for the feature you choose; unnecessary information is not made contractual merely by these Terms.
6.2 Where an optional use requires consent, we request it separately and you may withdraw it for future processing without affecting earlier lawful processing. Full-name Winner publicity is based on your separate post-win consent; withdrawal stops future publicity under our control. Accepting the Terms or reading this Policy is not consent to unrelated marketing. Device permissions can be managed through your device settings; turning off a permission may prevent the associated feature from working.
6.3 We rely on legitimate interests for proportionate fraud prevention, service security, investigation of misuse, evidence of handover, and establishment or defence of legal claims, balancing those interests against your rights. We process information to meet applicable legal duties, including binding court/authority orders and relevant accounting or tax requirements, where those duties apply. Optional handover evidence must be limited to what is justified for the stated purpose; any use requiring consent is subject to clause 6.2.
7. Automated eligibility and selection
7.1 Country/radius rules and Scan prerequisites are evaluated automatically. Residence eligibility uses the registered country and confirmed pin at pool freeze. Random Draws operate on valid Entries; Top Scans ranks valid Entry counts with a recorded tie method. These processes affect inclusion and Prize selection. The app's published rules explain the relevant mechanics.
7.2 Integrity signals do not themselves erase Entries or disqualify a Winner. A later eligibility dispute follows the recorded human decision process with an opportunity to respond. Contact support@tagnwin.com to raise a concern and privacy@tagnwin.com for associated data rights.
7.3 You may ask for human review of an eligibility or selection concern, explain your position and contest a decision through support@tagnwin.com. This is without prejudice to any safeguards and rights that apply to automated decision-making under data-protection law.
8. Sharing with Businesses and public results
8.1 On confirmation of a win, authorised fulfilment users may access the Winner's name, phone and email and the claim information needed for delivery. Access is logged and closes when that assignment closes. The Business does not receive your home address/pin, unrelated Member records or general browsing rights. Its use is limited to fulfilment, not marketing.
8.2 A scoped Winner/Delivery CSV may contain the permitted contact and delivery fields. It excludes Claim Codes, addresses, non-winners and reserves. Copies outside the platform require separate secure handling and retention safeguards. Public standings/results use pseudonymous identities by default; publishing a full name is a separate post-win choice.
8.3 The fulfilling Business is identified in the Competition and is responsible for its own use of the information to supply the Prize, keep required delivery records and handle related claims. TagNWin remains responsible for its platform disclosure and access controls. Each party must meet its applicable data-protection duties; fulfilment information may not be repurposed for marketing. You may contact privacy@tagnwin.com for help directing a request to the relevant Business.
9. Other recipients and international processing
9.1 Necessary information may be handled by authorised TagNWin personnel and contracted services for hosting, storage, communications, authentication/push, maps and security. Professional advisers, courts and public authorities may receive information where needed for legal duties or justified claims. Access is limited to the relevant purpose. Cloudflare provides public website hosting and network/security services as described in section 13.
9.2 Service providers and their support operations may process information in the EEA and other countries; Cloudflare operates a global network. Where a transfer outside the EEA requires safeguards, we use an applicable European Commission adequacy decision or appropriate safeguards, such as the Commission’s standard contractual clauses with any necessary supplementary measures. You may request information about the recipients, relevant countries and applicable safeguards, or a copy of the safeguards subject to necessary confidentiality redactions, from privacy@tagnwin.com. We do not represent all processing as EU-only.
10. Retention, closure and erasure
10.1 We keep identifiable information only while needed for the relevant service, legal or evidential purpose. Account/profile data is kept while the account is active and as necessary to complete closure, outstanding Prizes and justified claims. Entry, Draw, award and handover records are kept until the related Competition, claim periods and disputes are resolved, with longer retention only where a legal duty or specific legal hold requires it. Optional document numbers, photos and raw location/device evidence are kept only while needed for the specific verification or dispute purpose, rather than automatically for the full account lifetime.
10.2 Support and security records are retained until the enquiry or incident and any related claim are resolved; legally required records follow the applicable statutory period. Backup copies are restricted to recovery and expire through the relevant backup cycle; deletion instructions are reapplied after restoration. When the purpose expires, information is deleted or irreversibly anonymised unless a continuing lawful need justifies restricted retention. Pseudonymised records remain subject to this Policy. Contact privacy@tagnwin.com for the retention criteria applicable to a particular record or a rights request.
11. Security and access
11.1 Access is restricted according to the relevant role and purpose. Sensitive Winner reads and changes are recorded; credentials and Claim Codes must be protected. We take appropriate organisational and technical measures, but do not promise absolute security. Report a suspected incident to privacy@tagnwin.com or urgent account misuse to support@tagnwin.com.
12. Your rights and complaints
12.1 Depending on the processing and applicable conditions, you can request access, correction, erasure, restriction or portability and object to processing based on legitimate interests. You can withdraw consent where it is the basis. These rights have legal conditions and exceptions; account-closure restrictions do not remove the right to make a privacy request.
12.2 Contact privacy@tagnwin.com. We may seek proportionate identity verification and explain any lawful refusal or limitation. Applicable GDPR requests are answered without undue delay, normally within one month; a permitted extension of up to two further months requires notice and reasons within the first month. These are statutory requirements, not an optional support-service guarantee.
12.3 You may complain to a competent supervisory authority, including in your habitual residence, workplace or place of an alleged infringement. Relevant authorities include Cyprus's Commissioner for Personal Data Protection and Greece's Hellenic Data Protection Authority. You need not complete an internal complaint first.
13. Website technologies and traffic monitoring
13.1 The public website is hosted on Cloudflare Workers. We use Cloudflare’s aggregate HTTP and Worker metrics to monitor traffic, performance and security. This does not add a browser analytics beacon, advertising pixel, session replay, tracking identifier or optional analytics cookie. Fonts and illustrations are hosted with the site; language preference is carried in the URL rather than browser storage.
13.2 Cloudflare processes technical request data, including IP addresses, requested URLs, timestamps and browser/network information, to deliver and protect the website and produce operational metrics. Aggregate reports do not mean that all underlying network data is anonymous. We rely on our legitimate interests in providing a reliable, secure website and understanding its use. Website Worker application logs and traces are disabled. Cloudflare’s necessary network and security records follow the applicable service retention settings and incident requirements. See the website’s Cookies & technology notice for details; contact privacy@tagnwin.com for information about processing and your rights.
14. Children and changes to this Policy
14.1 The Member service is for adults aged 18 or over. Contact us if a child has registered or supplied information so the issue can be assessed through the appropriate account, claim and privacy processes; do not send identity-document images to an unverified channel.
14.2 We publish identifiable policy versions and explain material processing changes through the appropriate notice. Where a new use requires consent, a policy update alone does not supply it. Greek and English sections are intended to be equivalent.