Privacy Policy

1. Who we are

MCR Labs Ltd ("we", "us") is the data controller for your personal data. Registered in England & Wales under number 17228923, registered office 10 Sproston Place, Middlewich, CW10 0FY. Contact us about your data at privacy@packbutchercomps.co.uk.

2. The data we collect

• Account & identity: name, email, hashed password, date of birth / age confirmation.
• Contact & delivery: postal address and phone (for prize delivery and winner verification).
• Competition & transaction: competitions entered, tickets, orders, site-credit balance and, for entries made while competitions had a skill question, the answers you gave.
• Games, quests & rewards: the quests you complete and the Cuts they earn, the days you open a free pack (for your streak), badges, your Sidequests and Pack Beasts cards, packs opened and race places, Pack Points, your Butcher's Ladder progress and the rewards you claim. For posted Ladder rewards, we use the name and address on your account to arrange delivery. If you link Discord, we store your Discord user ID.
• Live-draw codes: which codes you used and when, and a short log of your code attempts (the time and whether the code was right), used only to stop code guessing.
• Draw reminders & app notifications: the live draws you ask us to remind you about and whether each reminder went by app notification or email. If you use our iPhone app and allow notifications, your device's push notification token.
• Payment: processed by Cashflows (our UK payment provider). We do not store your full card number.
• Free postal entry: the details you include on a postal entry.
• Technical & usage: IP, device/browser, the cookies and browser storage described in our Cookie Policy and, if you arrive through one of our campaign links, the campaign label (for example which social channel), which we save to your account when you sign up.

Our Competitions are for adults aged 18+ only; we do not knowingly collect data from anyone younger.

3. How and why we use your data

We use your data to create and manage your account, process entries and payments, run instant-win checks and the main draw, verify winners and deliver prizes, prevent fraud, meet tax obligations, respond to queries, and (with your consent) send marketing. Our lawful bases are performance of a contract, legal obligation, legitimate interests, and consent.

We use the games, quests and rewards data above to run those features (tracking your quests, streak, badges, cards and Ladder tier, paying site credit and posting rewards you claim) and to send the draw reminders you ask for; this is performance of our contract with you. We also use it in our legitimate interests to keep the games fair: spotting multiple accounts, automated play and code guessing, and correcting errors.

4. Marketing

We only send marketing where you have opted in or where the law allows us to email existing customers about similar competitions. Every marketing email has an unsubscribe link. Opting out does not stop essential service messages (order confirmations, ticket allocations, winner notices).

Draw reminders are not marketing: we only send one when you ask for it, for that draw. You can turn a reminder off at any time by tapping the same button again, and you can turn off app notifications in your phone's settings.

5. Who we share it with

We do not sell your data. We share it only with our processors: Cashflows (card payments), Supabase (database & accounts), our email provider, Vercel (hosting), Amazon Web Services (to stream our live draws), Apple (to deliver app notifications, if you use our iPhone app) and, only if you opt in to WhatsApp updates, 360dialog and WhatsApp (Meta) to deliver those messages; plus professional advisers and authorities where legally required. All act under written agreements. After an entry we also pass your name, email address and order reference to Trustpilot so it can invite you to review us, and if you link Discord, Discord shares your Discord user ID with us.

6. International transfers

Some providers may process data outside the UK/EEA. Where they do, we rely on appropriate safeguards such as an adequacy decision or Standard Contractual Clauses.

7. How long we keep it

Account data is kept while your account is active; transaction and tax records for 6 years; competition and winner records for a period to demonstrate fairness and handle disputes; postal entries until the competition concludes; marketing data until you unsubscribe.

Games, quests, streak, badge and Ladder records are kept while your account is active. Ladder reward claims, and the site credit and deliveries they create, are kept with our transaction records. The log of live-code attempts is only needed for a day and old attempts are deleted. You can remove a draw reminder yourself at any time. When you delete your account we remove your name, email address, phone number, postal address and linked Discord account from it, and delete your draw reminders and push notification tokens.

8. Your rights

You have the right to access, rectify, erase, restrict or object to processing, data portability, and to withdraw consent. To exercise any right, email privacy@packbutchercomps.co.uk. We respond within one month. Some rights are limited where we must keep records for legal or tax reasons.

9. Cookies

We use strictly necessary cookies to keep you signed in, a cookie that remembers which campaign link brought you to the site, and your browser's local storage for settings such as your chosen look, sound and basket. We don't use analytics or advertising cookies. See our Cookie Policy for the full list.

10. Security

We use encryption in transit (HTTPS), hashed passwords, access controls and reputable processors. Card data is handled by Cashflows under PCI-DSS and never stored on our systems.

11. Complaints

If you have a concern, please contact us first at privacy@packbutchercomps.co.uk. You may also complain to the ICO at ico.org.uk.

12. Changes

We may update this policy; the current version is always on the Website.