PRIVACY POLICY

Last Updated: May 2026

AR Competitions Ltd ("we", "us", "our", or "Company") operates the airriflecomps.co.uk website and mobile application (the "Service").

This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data. We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. INFORMATION COLLECTION AND USE

We collect several different types of information for various purposes to provide and improve our Service to you.

Types of Data Collected:

• Personal Data: While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you ("Personal Data"). This may include, but is not limited to:

• Email address
• First name and last name
• Phone number
• Address, postcode, city, and county
• Age verification status
• Cookies and Usage Data

• Usage Data: We may also collect information on how the Service is accessed and used ("Usage Data"). This may include information such as your computer's Internet Protocol address (IP address), browser type, browser version, the pages you visit, the time and date of your visit, the time spent on those pages, and other diagnostic data. IP addresses are classified as personal data under UK GDPR and are retained for security monitoring purposes for a maximum of 90 days before being anonymised.

2. USE OF DATA

AR Competitions Ltd uses the collected data for various purposes:

• To provide and maintain our Service
• To notify you about changes to our Service
• To allow you to participate in competitions
• To process ticket purchases and payments
• To provide customer care and support
• To provide analysis or valuable information so that we can improve our Service
• To monitor the usage of our Service
• To detect, prevent, and address technical issues and fraud
• To send you marketing communications where you have given consent

3. LEGAL BASIS FOR PROCESSING

We process your personal data on the following legal bases under UK GDPR:

• Contract performance: Processing necessary to fulfil your ticket purchase and competition entry.
• Legitimate interests: Security monitoring, fraud prevention, and service improvement.
• Consent: Marketing emails and SMS messages, which you may withdraw at any time.
• Legal obligation: Retaining transaction records as required by HMRC and applicable law.

4. DATA RETENTION

We retain your personal data only for as long as necessary for the purposes set out in this Privacy Policy. Specifically:

• Account data is retained for the duration of your account and for 7 years after account closure to comply with financial record-keeping obligations.
• Order and payment records are retained for 7 years in compliance with HMRC requirements.
• Security and IP address logs are anonymised after 90 days.
• Marketing consent records are retained until you withdraw consent.

5. INTERNATIONAL DATA TRANSFERS

Your personal data is stored on servers operated by TiDB Cloud (PingCAP Ltd), which are located in the United States (AWS us-east-1, Virginia). As the US does not benefit from a UK adequacy decision, this transfer is made subject to appropriate safeguards, including Standard Contractual Clauses (SCCs) as approved under UK law.

Email delivery is processed by Resend Inc., a US-based service provider. This transfer is similarly subject to appropriate contractual safeguards.

By using our Service, you acknowledge that your data may be transferred to and processed in the United States under these safeguards.

6. SUB-PROCESSORS

We use the following third-party sub-processors to operate our Service:

• TiDB Cloud (PingCAP Ltd) — database hosting (US)
• Resend Inc. — transactional email delivery (US)
• Stripe Inc. — payment processing (EU/US, PCI-DSS compliant)
• Manus — application hosting and infrastructure

We ensure all sub-processors are bound by appropriate data processing agreements.

7. YOUR DATA RIGHTS UNDER UK GDPR

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the following rights:

• Right of Access (Article 15): You have the right to request a copy of the personal data we hold about you. You can exercise this right directly from your Account page by clicking "Download My Data".

• Right to Rectification (Article 16): You have the right to request correction of inaccurate personal data. You can update your profile directly from your Account page.

• Right to Erasure (Article 17): You have the right to request deletion of your personal data ("right to be forgotten"). You can exercise this right directly from your Account page by clicking "Delete My Account". Note that we may be required to retain certain transaction records for legal and financial compliance purposes.

• Right to Restrict Processing (Article 18): You have the right to request that we restrict the processing of your personal data in certain circumstances.

• Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, machine-readable format. Use the "Download My Data" feature in your Account page to export your data as a JSON file.

• Right to Object (Article 21): You have the right to object to the processing of your personal data for direct marketing purposes. You can withdraw marketing consent at any time from your Account settings or by using the unsubscribe link in any marketing email.

• Rights related to automated decision-making: We do not make solely automated decisions that produce legal or similarly significant effects about you.

To exercise any right not available through your Account page, or if you have any questions about how we handle your data, please contact our Data Protection contact at:

Email: [email protected]

Post: AR Competitions Ltd, Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA

We will respond to all data subject access requests within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at https://ico.org.uk or by calling 0303 123 1113.

8. COOKIES

We use cookies and similar tracking technologies to track the activity on our Service and hold certain information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. A cookie consent banner is displayed when you first visit the site.

9. SECURITY

The security of your data is important to us. We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include password hashing, encrypted connections (HTTPS), and rate limiting on authentication endpoints.

10. CHILDREN'S PRIVACY

Our Service is not directed to anyone under the age of 18. We do not knowingly collect personally identifiable information from anyone under 18. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us.

11. CHANGES TO THIS PRIVACY POLICY

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

12. CONTACT US

If you have any questions about this Privacy Policy, please contact us: