Privacy Policy

Effective date: 5 October 2026

Last updated: 11 October 2026

Your information at a glance

We need some information to run your account, verify tickets and pay prizes. Optional survey matching and promotional notifications are separate choices. Saying no does not remove valid tickets already earned. Surveys may be unavailable if you do not allow the information needed to match them. Advertising choices have their own controls. Contact support@adwin.uk if you want help, a copy of your information, a correction or deletion.

1. Who is responsible

Adwin Tech Ltd is the controller of personal information used to operate Adwin. Company number: 16694520. Registered address: 1 Lindop Road, Hale, Altrincham, WA15 9DZ, United Kingdom. Email: support@adwin.uk. We apply UK data-protection law, including the UK GDPR, Data Protection Act 2018 and applicable amendments, and the Privacy and Electronic Communications Regulations.

Independent survey, advertising, sign-in and payment providers may also be controllers for their own processing. Their notices apply to that processing; this does not remove Adwin's responsibility for information we share with them.

2. Information we use and where it comes from

Account and eligibility: your name, email, mobile number, verification status, date of birth, postcode, account ID, and information returned by a sign-in service you choose, such as a provider ID, name, email or profile image. We do not receive your Google, Apple or Facebook password. Authentication services may create a technical account before you finish your Adwin profile.

Optional profile survey: gender, including “Prefer not to say”, postcode, employment, education, household income band, household size, number of children under 18 and your survey choices. These questions are optional and we explain their purpose in the app. Do not enter health information or other sensitive details into general profile fields.

Participation: task sessions, completion and rejection status, timestamps, ticket credits and debits, streak history, referral attribution, squad membership and removals, pokes, charity votes, draw entries, wins and claims. We receive reward transaction identifiers and validation or reversal information from providers. We also receive task revenue information used to calculate funds; these records can be linked to an account or session and are not always anonymous.

Payments: account-holder name, sort code, account number, payment references, amount, claim status and, if enabled, account-name validation results. Reusable bank details are stored in our Supabase database and used with Revolut for payouts. They are not solely held by Revolut. Removing saved details does not delete completed payment or legally required records.

Device, service and security: IP address, device/platform and app details, authentication/session identifiers, task/device bindings, server logs and error information. Advertising and survey services may collect additional device or browser signals, identifiers and fraud indicators under their notices. An IP address can indicate approximate location; this is different from GPS. We do not request precise GPS location for core signup. Survey websites or SDKs may have their own permissions and disclosures.

Notifications and support: push tokens, operating system, preferences, delivery/receipt status, message targeting categories and support correspondence. We receive information you provide directly, observations from your use, and provider callbacks. We do not upload your address book simply because you share a squad link.

3. Why we use it and our lawful bases

Account, authentication and task services: we use account, verification and session information to provide the service you request. This is necessary to perform our contract with you.

Tickets, draws and claims: we use participation, eligibility and payout information to operate draws and administer valid prizes. This is necessary for our contract with you and, where applicable, to meet financial record-keeping obligations.

Security and fairness: we use security, device and relevant account records to protect accounts, detect abuse and investigate errors. This is in our legitimate interests in running a secure and fair service.

Optional survey matching: we share the matching information described below with enabled providers only where you have made the in-app survey matching choice. This is based on your consent.

Optional promotional notifications: we use a push token and relevant activity category only where you have chosen notifications and the device permission allows delivery. This is based on consent.

Advertising: we use consent signals, device identifiers and ad information as required by PECR and UK GDPR.

Support and accounts: we use relevant revenue, financial and support records to reconcile revenue, help users and maintain auditable records. The basis is contract, legitimate interests or a legal obligation depending on the purpose.

Consent is a choice, not a condition attached to every use of your data. Where we rely on legitimate interests you can object. We assess children’s interests separately. We do not treat general acceptance of the terms as advertising or marketing consent.

4. Surveys and profiling

With the combined survey choice enabled, Adwin sends matching information to TheoremReach, CPX Research (Make Opinion GmbH), AyeT Studios, Tap Research and Prime Surveys (PrimeEarn) where each provider is enabled in Adwin. TheoremReach receives age derived from date of birth; CPX and Prime receive date of birth. Prime also receives your Adwin account identifier, connection IP, browser/device information and supported gender if supplied; our current Prime integration does not send UK postcode. Prime is included only after you accept the updated survey-sharing choice. Matching may use your Adwin identifier, age or date of birth, UK country, postcode, IP address, gender where supplied, device information and relevant participation information. Each provider receives only the fields its enabled integration needs. We update this notice and ask for fresh consent where required before materially expanding the categories of data or providers. Choosing “Prefer not to say” does not send an invented gender. Interests are optional profile information; we must not claim a provider receives them unless the integration actually sends them.

Matching uses demographic quotas and security checks, so it is profiling. The provider may decline a match even when surveys exist. We ordinarily receive completion, transaction, reward and rejection information rather than the full answers you give within the provider's survey. Survey responses and additional screening questions are handled under the provider's own notice. If a survey asks for sensitive information, read its explanation and consent request before answering; you can stop.

You can withdraw future matching/sharing permission in Privacy choices. This does not erase information already lawfully shared or cancel an existing valid reward. Contact us and the provider for deletion or access to historical survey information. Provider notices are available through the survey experience and from the provider: TheoremReach at https://info.theoremreach.com/privacy-policy/en-uk/ and CPX at https://www.cpx-research.com/main/en/privacy.php. AyeT and Tap Research provide their notices in their respective survey or offer experience.

Adwin accounts and survey access are restricted to adults aged 18 or over. Do not misstate your age or other demographic information to qualify for a survey.

5. Advertising and device choices

Google AdMob supplies rewarded advertising and completion/revenue signals. Adwin provides separate advertising privacy controls before requesting ads where required. Advertising partners can process identifiers, IP, device data and interactions as described in their notices and consent form. A non-personalised ad is not necessarily free of device storage or measurement; we still apply the relevant consent requirements.

You may refuse or change optional choices. Ad availability may differ, but refusal does not revoke existing tickets. On iOS, any required Apple tracking permission is separate from Adwin's notice and Google's consent form. We must not access tracking identifiers before the applicable permissions. Read Google's notice at https://policies.google.com/privacy.

Core app session storage keeps you signed in. The public website may use different storage technologies; its cookie/storage notice and controls must accurately identify those technologies before any non-essential use. This notice is not itself a cookie-consent banner.

6. Squads, referrals, votes and visibility

Squad features show limited member information such as your displayed name/avatar, membership, activity status and relevant task or ticket contributions. This lets members understand squad participation and send available pokes. Your bank details, date of birth, email, mobile number and survey answers are not intended to be visible to squad members. We do not publish your individual charity vote as a public profile label.

We use AppsFlyer OneLink and its app integration to route referral links to the relevant app or store and associate an installation or app opening with a referral where supported. This can involve referral/link identifiers, click and installation events, IP address and device/app information. Adwin validates referral eligibility and ticket awards on its own server. Your saved bank details and full survey answers are not sent to AppsFlyer for this purpose. Applicable device-storage and tracking choices remain separate from accepting our terms. AppsFlyer’s privacy information is available at https://www.appsflyer.com/legal/processing-customer-data/.

Sharing a referral code reveals that code and any information in the message you choose to send through your messaging app. The messaging provider handles that sharing under its own terms. Sharing is initiated by you, not by uploading your contacts to Adwin.

7. Recipients and service providers

We use Supabase for authentication, database and backend services; Google AdMob for advertising and revenue reporting; TheoremReach, CPX Research (Make Opinion GmbH), AyeT Studios, Tap Research and Prime Surveys (PrimeEarn) for survey or offer inventory where enabled; AppsFlyer for referral-link routing and attribution; Revolut for bank payouts and, when available, account-name checks; Expo and Apple APNs/Google FCM for push delivery; and Vercel for the public website, referral pages and back office. Google, Apple and Facebook receive information when you choose their sign-in route. Twilio delivers mobile-verification text messages and processes the phone number and message/delivery information needed for that service. Email delivery suppliers process the address and delivery information needed to send account messages. Twilio’s privacy notice is available at https://www.twilio.com/en-us/legal/privacy.

Authorised staff access only information needed for their role, such as support, draw administration and payments. Relevant advisers, courts, regulators or law-enforcement bodies may receive information when there is a lawful reason. If the business changes ownership, information may be transferred with appropriate safeguards and notice.

We do not provide advertising or survey partners with your saved bank account credentials for targeting. Necessary payment details go to the payout provider. We do not describe all partner processing as anonymous, or promise that no partner ever acts as an independent controller.

8. Where information is processed

Our configured Supabase project is in the UK. That does not mean all processing stays in the UK: hosting support, push, advertising, surveys, sign-in and payment services may process information in other countries, including the United States.

For restricted transfers for which Adwin is responsible, we use an applicable UK adequacy arrangement or appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum to EU standard contractual clauses, with the required transfer assessment. Ask support for information about relevant safeguards or a copy, with confidential details redacted where appropriate.

9. Retention and deletion

We retain information only for its purpose, a relevant legal requirement or the reasonable period needed to resolve a claim. Account/profile data is needed while your account is active; optional saved bank details are kept for future claims until you remove them or close the account, except information needed for a payment already underway or lawful records.

Financial, prize and accounting evidence may need to be retained for six years from the relevant accounting period, or longer where law or an ongoing dispute requires it. This is not a blanket six-year period for every interaction. Security logs, unsuccessful signup records, expired tokens and support cases need separate limited retention periods. Consent evidence records the wording/version, choice and time, including withdrawal where applicable. Backups expire under the configured backup schedule and retained deletion instructions must be reapplied if a backup is restored.

10. Automation, errors and human review

Software validates tasks, calculates balances, matches notification audiences and selects draw winners. Notification audiences may include recent activity, completed streaks, squad status and recent wins. These are personal-data uses, even if no name appears in an outgoing API call.

Provider fraud flags can restrict a task or trigger review. We do not assume every automated restriction is harmless or that all such decisions fall outside legal safeguards. If an automated decision affects you, contact support to ask for an explanation, human review, or correction and to challenge the outcome. We preserve relevant audit evidence and consider applicable safeguards for significant automated decisions, especially for children.

11. Your choices and rights

Depending on the circumstances, you can request access and a copy, correction, erasure, restriction, portability, or object to processing. You can withdraw consent at any time without affecting earlier lawful processing. You can object to direct marketing at any time. Rights are subject to legal conditions, which we explain where they affect a request.

Privacy choices in the app provide survey controls and links to advertising controls and help; notification settings control optional pushes. Contact support@adwin.uk for a data request or complaint. We may ask for proportionate verification. We normally respond to rights requests within one month; where the law permits an extension or clarification period, we explain it. Requests are normally free.

You can complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/. You do not have to waive that right or agree with our response first. We acknowledge data-protection complaints within 30 days, investigate and respond without undue delay. Use the subject “Privacy complaint” if helpful, but special words are not required.

12. Children and age checks

Adwin does not permit under-18 accounts. We collect date of birth to check eligibility and may seek proportionate further verification. If we discover an under-18 account, we restrict access and handle deletion and any necessary records appropriately. A statement that the service is 18+ is not a substitute for assessing whether children are likely to access it and applying any Children's Code obligations that result.

Contact support if you think information about a child is being handled incorrectly. We assess age assurance and the risk of children accessing the service and do not use their data for optional survey matching when their age is known to be below 18.

13. Security and changes

We use access restrictions, authenticated services and transport security. We do not promise perfect security or claim bank data has separate field-level encryption unless it does. If a breach occurs, we assess and make any required regulator and affected-person notifications.

We update this notice when our processing changes, keep identifiable versions and draw material changes to your attention before new uses begin. Where fresh consent is needed, we ask for it separately.