Short version: we collect what the contest needs, we do not sell anything, and you can have it deleted.
Last updated 1 August 2026
| What | Why | How long |
|---|---|---|
| Name and email | Your account, and telling you if you won | Until you delete the account |
| Age confirmation | The contest is 18 and over | Until you delete the account |
| Your photo or video | Displaying and judging your entry | Until you withdraw it. Winner pages stay as the public record |
| Social handle and post link | Verifying shares for your score | The contest, plus 12 months |
| Address, product choice and any measurements | Making and shipping a prize | 7 years, because tax and customs records require it |
| IP address and device | Catching duplicate votes and bots | 13 months |
Our hosting, email and analytics providers, and Scottish Kilt for making and shipping prizes. That is the full list. We do not sell personal data and we do not share it with data brokers. Where a provider sits outside the UK or EEA we use standard contractual clauses.
The licence you grant when you enter is set out in clause 7 of the contest rules, and it includes advertising use. You keep the copyright. You can withdraw an entry any time from your dashboard and we take it down within 7 days.
Many entries contain no people at all, such as a throw, a room or a piece you made. Where an entry does contain people, the consent rule in clause 6 applies.
Entering does not subscribe you to anything. The newsletter is a separate tick box and every email carries a one click unsubscribe.
FreeKilt is for over 18s. If we find an account belongs to someone younger we delete it and everything uploaded from it. If you have entered a photograph containing a child, you have confirmed you are their parent or guardian or have that permission. Tell us if that changes and we take it down.
Ask us for a copy of your data, a correction, or a deletion, and we will do it within 30 days at no charge. You can withdraw consent at any time.
UK residents can complain to the Information Commissioner's Office. EEA residents can complain to their national supervisory authority. California residents have the right to know and the right to delete under the CCPA. Canadian subscribers: our newsletter runs on express consent with an unsubscribe in every message, as CASL requires.
Everything travels over TLS, passwords are hashed, and access to entry data is limited to the people who need it. If a breach affects you we tell you and the regulator within 72 hours.
Before publication: insert the controller entity name, registered address and a contact email.