Last updated: 04 August 2026
Table of contents:
About this Notice
This Privacy and Cookie Notice (this “Notice”) describes how ITV Consumer Ltd. and Global Media Group Services Ltd. ("we", "us" or "our") collect, use, and share your personal data as joint controllers in connection with your use of The Birthday Draw website and app (“services”). This Notice describes the rights and choices you have in relation to our processing of your personal data. We have also included information about our use of cookies and similar technologies in section 10.
The Birthday Draw is a service by ITV Consumer Ltd. and Global Media Group Services Ltd. It is important for the operation of our service that your personal data is transferred between these entities to enable us to provide our services to you. We are “joint controllers”. This means we jointly determine how and for what we use your personal data, as described in this Notice.
Who is doing what?
ITV Consumer Ltd., through its trusted technical partners, is the business that conducts the day-to-day handling of your personal data when you interact with our services (for example, operating and maintaining the technical aspects of our services), as it collects this information and has direct contact with you, due to your contractual relationship when you interact with The Birthday Draw and as further set out in this Notice.
Global Media Group Services Ltd. provides certain marketing, promotional, operation and production support services, which may include the production of advertising content for use in connection with The Birthday Draw.
What information do we collect?
Personal information which you provide to us includes:
“ Registration Data ”: We may collect all or some of the following when you register for, sign in, or update your account:
Additional personal information you may choose to give us:
Personal data collected through your use of our services (we call this “Usage Data”) includes:
We may collect the following technical information automatically:
We collect your general location. We may learn your general (non-precise) location from technical information (such as, town or city), for example by detecting your IP address. We need this to meet our geographical requirements to “geo-block” or regionalise our services and prevent you from accessing them from outside the United Kingdom, and other permitted territories as per the applicable terms and conditions to our services.
Why we use your personal data
We have set out in the section below each purpose, legal basis we rely on and the categories of personal information we use for each processing activity. Sometimes more than one legal basis will apply
Purpose | Legal bases | Personal data we use |
|---|---|---|
To provide you access to our services, including personalising its content for you, such as:
| Necessary to perform our contract (terms and conditions) with you. | Registration Data and Usage Data |
| To fulfil any prizes you win under our services. | Necessary to perform our contract (terms and conditions) with you. | Registration Data, payment card and/or financial details and information necessary to verify your identity. |
To handle your queries and complaints:
| Necessary to perform our contract (terms and conditions) with you.
Compliance with our legal obligations.
Our legitimate interest to maintain effective services and defend legal claims. | Registration Data and Usage Data. |
| To understand, improve and enhance user experience (including testing different versions of our content or layout on our services), and measure how people are using our services, to monitor and improve the operation, delivery, and general accessibility of our service, this may also include conducting internal research and development of our services. | Our legitimate interest in maintaining a service that is accessible and attractive to users. | Registration Data and Usage Data. |
| To understand user journeys to and on our services to determine whether users complete registration (and so we can remind you to complete your registration journey). Also, so that we can improve our services and keep you coming back for more! | Our legitimate interest in maintaining a service that is accessible and attractive to users. | Registration Data and Usage Data. |
To provide you with other marketing, promotions or ads (where the law does not require consent):
| Our legitimate interest of maintaining a service that is accessible and attractive to users.
You can unsubscribe from receiving email marketing communications by selecting unsubscribe in the email itself. You can also unsubscribe from marketing text messages by following the instructions set out in those messages.
If you can't unsubscribe in these ways then 'Contact us' as established in this Notice. | Registration Data and Usage Data. |
| To provide you with other marketing, promotions or ads (where the law requires consent) | Consent.
You can unsubscribe from receiving email marketing communications by selecting unsubscribe in the email itself. You can also unsubscribe from marketing text messages by following the instructions set out in those messages.
If you can't unsubscribe in these ways then 'Contact us' as established in this Notice. | Registration Data and Usage Data. |
| To establish, exercise or defend legal claims. | Compliance with our legal obligations.
Our legitimate interest in protecting our services, brand and their viability as a business. | Registration Data and Usage Data. |
| To promote our services to the public and other users. This may include, if you win a prize, showing your first name and general location (for instance, county) within our website, marketing communications and any other promotional sites or spaces at our discretion. | Our legitimate interest of maintaining a service that is accessible and attractive to users. | Registration Data and any other information you provide to us when participating in our promotional activities. |
Sometimes we may record calls with winners for auditing, compliance with our legal obligations and training purposes. They will always be informed at the beginning of the call as to whether a recording is in progress.
The recording will only be used for marketing purposes with the winner's consent, which may include posting on our website, app and/or related social media your name, publication and/or image (e.g., a selfie provided by you) to promote our services. We will only post your image with your consent. | Our legitimate interest in protecting our services, brand and their viability as a business.
Consent to use the recorded call, any images and/or information provided by you to promote our services. | Registration Data, information captured in any recorded calls and well as any information and/or images provided by you. |
When you attend one of our events, offices and/or venues, to take publicity or promotional pictures or videos and/or generate other promotional materials (including social media posts) that relate to the event and/or our services.
We also may collect photos or videos at events through our authorized photographers or event attendees who voluntarily share their photos or videos with us. These photos or videos may be taken during various activities, such as conferences, workshops, social gatherings, or other events organized or supported by us.
Our use of this information may include selecting, editing, and enhancing the photos or videos to ensure their quality and relevance; sharing the photos or videos on our social media platforms; promoting future events, activities, or initiatives related to our products and/or services; displaying the photos or videos on our website, newsletters, brochures, or other promotional materials. When sharing the photos or videos, we take reasonable steps to respect your privacy rights.
If you're attending an event at which there may be photography or video recording taking place, you can let us know and we will make reasonable efforts to not capture or retain any images or footage of you. If you can, let us know by emailing us at myprivacy@itv.com, stating what event you will be attending and when. If you've not been able to let us know in advance or have any questions or concerns at an event, please direct these to the photographer or videographer on site. | Where you're invited to our offices or one of our events and/or venues, our legitimate interest in protecting our services, brand and their viability as a business.
For promotional materials created outside of our offices, events and/or venues, we'll get your consent in line with the applicable release form that will be provided to you where necessary. | The personal data you provide during the event and/or production, including any photographs or videos that capture your likeness. |
How long do we keep your personal data for?
We keep your personal data where we have an ongoing legitimate or lawful need to do so. When we no longer have a legitimate or lawful need to keep your personal data, we will delete it or anonymise it.
Data sharing, and international transfers, and changes to our busines
Our service providers or other third parties we work with may be based outside the UK, for example, in Europe or the United States. In these cases, we will ensure that your personal data is protected in line with UK data protection laws.
This means we only transfer your personal data where it is permitted under UK data protection laws. The main transfers take place if:
We may also take steps to identify and use additional protections as appropriate for each data transfer. For example, we may require the use of:
We review our service providers before we use them and also ensure that they are only allowed to access the information they need to perform the services we request.
We may also provide your personal data to companies that help us in providing our service, or that assist us in improving our products, content, services, or advertising.
We may share your personal data with:
We may combine all the information we collect from or receive about you for the outlined purposes. We may aggregate or de-identify your information and may use or share aggregated or de-identified information for any purpose, and such information is not subject to this Notice.
In the event of changes to our business, for example, if we decide to change or restructure our business, we may need to pass your personal data to one of our group companies so we can continue to effectively deliver our service. However, if we become involved in a merger, acquisition, restructuring, reorganisation or other transaction involving the sale of some or all of our assets, then your information may be included in the assets that are transferred to the new owner and may be provided to the entities and advisors involved. Such a transaction could involve us: (i) retaining the right to continue to use transferred personal data in addition to the right of the new owner to use such information; and (ii) engaging in additional transfers of personal data (including new personal data) with the new owner from time to time following such a transaction.
If there are changes to our business (such as a re-organisation or restructuring), your personal data will remain subject to this Notice (as amended from time to time). However, where your personal data is transferred to a new owner following a merger or acquisition it may be subject to a different privacy notice. We, or the new owner, will provide notice to you before any of your personal data becomes subject to a different privacy notice.
How we keep your personal data safe
We're committed to protecting your personal data and keeping it secure, private and confidential. We put in place appropriate technical and organisational measures to help protect the security of your personal data. Unfortunately, no measures can ever be completely secure. We have implemented various safeguards to protect against unauthorised access and unnecessary retention of personal data in our systems. These include pseudonymisation, encryption, restricting access, and retention policies.
Your rights
We are committed to respecting the rights that individuals are entitled to under data protection laws in the UK. These are:
You also have the right to lodge a complaint with the supervisory authority. If you wish to make a complaint about how we use your information, please contact us at privacy@itv.com and we will do our best to help. If you remain unsatisfied with our response, you can contact the Information Commissioner's Office via their website ( https://ico.org.uk ).
Please be aware that these rights are not absolute and there may be some situations in which you cannot exercise them, or they may not be relevant.
Who will respond when you exercise your rights as a data subject?
Our services are operated by ITV Consumer Ltd. through trusted technical suppliers. Therefore, in relation to the operation of The Birthday Draw, ITV Consumer Ltd. will respond when you exercise your rights as a data subject. As ITV Consumer Ltd. and Global Media Group Services Ltd. act as joint controllers for The Birthday Draw, you may exercise your data protection rights in respect of your personal data against either company, and ITV Consumer Ltd. will coordinate responses with Global Media Group Services Ltd. where needed.
Links to third party sites
Our service may include links to other sites, products, or services that we do not own and are not operated by us, and whose privacy practices may differ our own. If you click a third-party link, you will be directed to that third party's site. If you submit personal data to any such third-party sites or otherwise submit personal data to such third parties, your information is governed by the pertinent third party's privacy policies. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services, and this Notice does not apply to your activities on any third-party sites or services or any information you otherwise disclose to any third parties. We encourage you to carefully read the privacy policy of any site you visit.
Cookies and similar technologies
This section describes how cookies and similar technologies are used to support our services and the controls which may be available to you. We may also use other technologies that do not rely on cookies to store or access information on your device. For further information on when we collect technical information automatically, please see section 3 above.
What are cookies and similar technologies?
From now on we will refer to these technologies collectively as 'cookies'. Cookies are typically used by websites or where apps have embedded web browsers which allow them to access the internet.
Why do we use cookies and what types of cookies do we use?
Essential: these cookies are necessary for our service to work. Without these cookies, we can't provide you with our core functionalities and associated services such as login and security, so these are not optional. Some of these types of cookies also provide you with features which you choose to use. They may also help with the following:
Performance and Functionality: these are used to produce reports to help us improve our site and measure how well new features or functionalities perform. These cookies are only deployed with your consent via the website's cookie banner.
We also use Google Analytics which is an analytics and measurement service provided by Google. Google Analytics sets a cookie in order to evaluate use of our service, where we have implemented it, and compile a report for us. Google Analytics records visits to our website to help us know:
You can find out more about how Google uses data at https://policies.google.com/technologies/partner-sites?hl=en-GB You can also install a browser plugin - https://chrome.google.com/webstore/detail/google-analytics-opt-out/fllaojicojecljbmefodhfapmkghcbnh?hl=en-GB to opt out from Google Analytics across all websites you visit (including our website).
Targeting: These cookies are used to build a profile of your online behaviour and interests to show you ads, about our products and services that we think you will like, in our services and also on other websites and services (including social media platforms) that you use. We use cookies which generate unique identifiers of your browser and/or device so that we can identify you or people who are similar to you who are also using other platforms or services (for example social media). This helps us to understand whether our marketing or promotions on third party platforms or services have been effective and to know whether people who see our marketing or promotions then come to use our services. We then use this information to help us make decisions about which third party platforms or services we should advertise on. These cookies also allow us to understand the effectiveness of our marketing and promotional emails (for example, whether you viewed or clicked on one of our emails and what you might have clicked on next). You can withdraw your consent for targeting cookies but you may still see ads; they may be less interesting or relevant for you.
We do not have any control over the data collection and use practices of third-party platforms. You should read and understand their respective privacy notices:
Meta (Facebook): https://www.facebook.com/privacy/policy
Meta (Instagram): https://privacycenter.instagram.com/policy?__coig_consent=1
Google: https://policies.google.com/privacy?hl=en-US
Tik Tok: https://www.tiktok.com/legal/page/eea/privacy-policy/en
These cookies are only deployed with your consent via the website's cookie banner.
How do I manage cookies?
Please be informed that you have the following controls in our services:
You can choose how cookies (across all websites) are handled on your device via your browser settings including to block or delete all cookies or just third party cookies. Each browser manufacturer is different, so check the "Help" menu of your browser to learn how to change your cookie preferences.
How we use your data for social media advertising and optimisation
We want to make sure the ads you see on social media about The Birthday Draw are helpful, relevant, and not repetitive. To do this, we use the services of digital advertising networks operated by Meta Platforms Ireland Limited (Facebook and Instagram) and TikTok Information Technologies UK Limited. We use these services to achieve the following:
- Stop redundant ads: If you are already an active premium subscriber, we tell Meta and TikTok to safely hide our membership ads from your social media feeds. This stops repetitive ads from cluttering your screen.
- Share promotions: If you have played individual draw games but have not subscribed, we may show you ads on social media (like Instagram and Tiktok) explaining the benefits of upgrading to a full subscription.
- Find new players: We use our general list of players as a baseline "seed" to help social media networks find other people in the United Kingdom who enjoy online games and prize draws. We only use basic contact details of The Birthday Draw users who haven’t objected to this data sharing.
- So that the social media platform can measure how you interact with The Birthday Draw ads on their platforms. To this end, Meta and/or TikTok may, with your consent granted via our website’s cookie banner, use cookies, web beacons, and other storage technologies to collect or receive information when you use our website and use that information to provide us measurement services, target and deliver Birthday Draw ads.
However, please note that the only data we share with these platforms is your registration data when you create a Birthday Draw account (email address and/or phone number) and minimal transactional information, such as the fact that you’ve made a purchase on our website.
How do we protect your data? We take your privacy very seriously and keep the information we upload to an absolute minimum:
- For Meta (Instagram and Facebook), we only use your email address and phone number that you provided to us when you created a Birthday Draw account.
- For TikTok, we use just your email address and phone number that you provided to us when you created a Birthday Draw account.
Before any of this information leaves our secure database, it is scrambled using a technical tool called SHA-256 hashing. This turns your actual email address or phone number into a long string of random letters and numbers that cannot be read as plain text.
Meta and TikTok use these scrambled codes solely to match you with their systems and are contractually bound to permanently delete our upload files as soon as that matching process finishes.
What is our lawful basis?
The primary lawful basis relied upon to execute this off-platform matching configuration is our Legitimate Interests. We have a legitimate commercial interest in minimising advertising waste, reaching interested customer bases, and expanding our platform footprint across the United Kingdom.
These optimisation activities are strictly limited to users who reside inside our active marketing database and have not opted out to this data sharing.
Who is responsible? Under UK data protection laws, we share responsibility with Meta and TikTok during the initial secure matching phase as joint data controllers. Once they match the scrambled codes to their networks, they take full standalone responsibility as independent data controllers for how ads are delivered and optimised on their platforms.
Your controls. We run these digital campaigns to keep our operations efficient and support our low-cost prize draw. However, you have an absolute right to object to this and turn it off at any time. You do so as follows:
- Go to your account's profile settings on our website and flip the toggle switch for third-party social media data sharing. We will immediately stop including your details in future advertising match lists.
- Alternatively, you can email directly at privacy@itv.com and we will update your preferences for you.
We do not have any control over the data collection and use practices of third party platforms. You should read and understand their respective privacy notices:
Meta (Facebook): https://www.facebook.com/privacy/policy
Meta (Instagram): https://privacycenter.instagram.com/policy?__coig_consent=1
TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/e
Contact us
If you have any questions or concerns about this Notice or our privacy practices, please contact us at myprivacy@itv.com or write to us at ITV UK Data Protection Officer, ITV Consumer Ltd., ITV White City, 201 Wood Lane, London, W12 7RU.
Changes to this Notice
We may change this Notice from time to time and we will notify you by revising the “Last Updated” date at the top of this Notice. If we change this Notice in a way that we believe materially affects how we process your personal data, we will provide you with advance notice such as via email or by posting a notice on the website, if applicable.