Privacy Policy

Last updated: 1 June 2026 · Version 1.0

1. Who we are

dragonworldcup.co.uk (“DragonWorldCup”, “we”, “us”, “our”) is operated by Dragon Sports Media Limited, a company registered in England and Wales.

Dragon Sports Media Limited is the data controller for personal data processed via this site. We’re registered with the Information Commissioner’s Office (ICO) under registration number ZA367891.

DragonWorldCup is operated by Dragon Sports Media Limited, the same Lovells Group subsidiary that operates DragonSports.co.uk. It sits within a wider Lovells Group portfolio that also includes DragonBet (a separately operated Lovells Group gambling business). DragonBet operates under a separate legal entity with its own UK Gambling Commission licence (64908). We do not share personal data with DragonBet without explicit consent or another lawful basis (see section 6 on prize fulfilment).

2. What this policy covers

This policy explains what personal data we collect, why we collect it, how we use it, who we share it with, how long we keep it, your rights, and how to contact us.

3. The personal data we collect

3.1 When you visit the site

  • Truncated IP address (last octet removed before processing)
  • Browser type and version, operating system, device type
  • Pages viewed, time on site, referring URL
  • Geographic region (country and city only, from IP geolocation)

Collected via Google Analytics 4 only after you consent through our cookie banner. Decline analytics consent and no analytics data is collected.

3.2 When you create an account to play our games

To play Fantasy Manager or Super 6 you create an account. We collect:

  • Email address
  • Display name / username
  • Password, stored only as a salted one-way hash — we never see or store your plain-text password
  • Registration date and IP address (for fraud and abuse prevention)

If you register using Google or Facebook sign-in, we receive only your name and email address from that provider. We do not access your contacts, posts, or any other data held by Google or Facebook.

3.3 Game data

  • Fantasy Manager: squad selections, transfers, captain choices, chip usage, league memberships and gameweek scores
  • Super 6: score predictions, points earned and matchday rankings
  • Private league names, join codes and membership records

3.4 When you subscribe to our newsletter

  • Email address, optional name, subscription preferences
  • Game-engagement tags (e.g. fantasy, super6) so we send only relevant updates
  • Open and click data on emails we send you

Newsletters are operated through Beehiiv (section 8).

3.5 When you contact us

  • Email address, name (if provided), the content of your message and any attachments

3.6 What we do NOT collect

  • Payment or financial information — our games are free to enter and we take no payments on this site
  • Identity-graph or cross-site tracking beyond standard analytics cookies
  • Biometric data
  • Personal data from anyone under 18 (see section 11)

4. Lawful bases for processing

Purpose Lawful basis
Providing your account and running the games you play Contract (UK GDPR Art. 6(1)(b))
Awarding and fulfilling free-bet prizes via DragonBet Contract (Art. 6(1)(b))
Site visitor analytics Consent (Art. 6(1)(a))
Newsletter delivery Consent (Art. 6(1)(a))
Responding to your contact emails Legitimate interests (Art. 6(1)(f))
Fraud and abuse prevention Legitimate interests (Art. 6(1)(f))
Compliance with legal obligations Legal obligation (Art. 6(1)(c))

Where consent is the basis, you can withdraw it at any time. Withdrawing consent doesn’t affect the lawfulness of processing before withdrawal.

5. How we use your personal data

  • Deliver the website and run your account and games
  • Calculate scores, leaderboards and award prizes
  • Send newsletters you’ve subscribed to
  • Improve our editorial coverage and game design
  • Respond to enquiries and complaints
  • Detect and prevent fraud, collusion and abuse
  • Comply with legal obligations

We do not use your personal data for automated decisions that produce legal or similarly significant effects on you.

6. Sharing your personal data

We share personal data only with:

  • Our processors (section 8), under written Data Processing Agreements
  • DragonBet, but only the email address of a prize winner, and only to credit a free-bet prize you have won (Art. 6(1)(b)). Redeeming a prize requires you to hold or open a DragonBet account, subject to their separate terms and identity checks. No other personal data is shared for prize fulfilment.
  • Other Lovells Group companies where there’s a lawful basis (e.g. you’ve opted in to DragonBet promotional content)
  • Regulators or law enforcement where required by law
  • Professional advisors (legal, accountancy, IT security) bound by confidentiality

We do not sell personal data.

7. International transfers

Where personal data is transferred outside the UK, we rely on a UK adequacy determination (including the UK-US Data Bridge for participating US recipients), ICO-approved Standard Contractual Clauses, or another lawful transfer mechanism. Specific transfers are listed in section 8.

8. Our processors

Processor Purpose Location Safeguard
20i / StackCP Web hosting United Kingdom Within UK
Google (Analytics 4) Site analytics EU/US UK-US Data Bridge
Google (Sign-in) Optional social login EU/US UK-US Data Bridge
Meta (Facebook Login) Optional social login Ireland UK adequacy (EEA)
Beehiiv Newsletter platform United States UK-US Data Bridge / SCCs
CookieYes Cookie consent management EU/UK Within UK/EU
Sportmonks Football data (no user data shared) Netherlands UK adequacy (EEA)

A current DPA is in place with each named processor. Contact privacy@dragonworldcup.co.uk for confirmation of a specific DPA status.

9. Retention

Data type Retention
Account & game data While your account is active, plus 12 months after closure (fraud and legal claims)
Historic leaderboards Duration of the tournament plus 12 months
Newsletter subscriber email Until you unsubscribe, plus 6 months for audit trail
Site analytics (GA4) 14 months (GA4 default)
Server access logs 30 days
Contact / email correspondence 24 months from last contact
Cookie consent records 12 months

10. Your rights

Under UK GDPR you have the right to access, correct, erase, restrict, object, and port your data, to withdraw consent at any time where consent is the basis, and to complain to the ICO. To exercise any right, email privacy@dragonworldcup.co.uk. We’ll respond within 30 days and may ask you to verify your identity first.

11. Age and audience

DragonWorldCup is intended for users aged 18 and over. The site carries betting odds, betting tips, and free-to-play games with free-bet prizes. To protect under-18s:

  • We do not allow account creation by anyone under 18
  • We do not knowingly collect personal data from anyone under 18
  • We will close any account and delete the associated data if we are notified that a user is under 18

If you believe a child has provided personal data, contact privacy@dragonworldcup.co.uk and we will delete it.

12. Cookies

We use cookies and similar technologies in these categories:

  • Strictly necessary (no consent required): login session, security, cookie consent record
  • Analytics (consent required): Google Analytics 4
  • Functional (consent required): newsletter signup behaviour, personalisation
  • Marketing (consent required): attributing affiliate link clicks to DragonBet, fired only with consent

Manage your preferences any time via the “Cookie Settings” link in the footer. For a full list, see our Cookie Policy.

13. Security

  • HTTPS / TLS 1.2+ across the site
  • Salted one-way password hashing for all accounts
  • Two-factor authentication for editorial admin accounts
  • SPF, DKIM and DMARC for newsletter email
  • Regular security updates to WordPress core, themes and plugins
  • Access to personal data limited on a need-to-know basis

No system is perfectly secure. If we become aware of a personal data breach likely to risk your rights and freedoms, we’ll notify the ICO within 72 hours where required, and affected individuals where required by law.

14. Changes to this policy

We may update this policy. Material changes will be flagged in the “Last updated” field and notified to registered users and newsletter subscribers by email at least 14 days before they take effect.

15. Contact and complaints

If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office: ico.org.uk · 0303 123 1113 · Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.