Privacy Policy — Highland Vault Ireland

Effective Date: August 2025
Version: 1.0
Controller: TVI Fife Limited, trading as Highland Vault

1. Who We Are

Highland Vault is a trading name of TVI Fife Limited,
a company registered in Scotland under company number
SC844459, with its registered office at:

3 Castle Street
Carnegie Campus
Dunfermline
Scotland
KY11 8PB

We are the data controller for the personal information described in
this policy. This means that we decide what information is collected,
how it is used, and how it is handled.

You can contact us about anything relating to this Privacy Policy at:

Email:
info@highlandvault.com

Data Protection Officer:
The Promoter can be contacted at info@highlandvault.com for data protection matters.

2. Our EU Representative

Because we are established in the United Kingdom and offer our
competitions to people in the Republic of Ireland, we have appointed
a representative in the European Union under Article 27 of the GDPR.

You may contact our EU representative on any matter relating to how
we handle your personal information:

EU Representative:
For matters relating to this Privacy Policy, you may contact TVI Fife Limited directly at info@highlandvault.com.

Contacting our representative does not replace your right to contact
us directly, or to complain to the Data Protection Commission.

3. Information We Collect

3.1 Account and Identity Information

We may collect:

• Your name, email address, postal address, telephone number and date
  of birth.
• Your username, password (stored in encrypted form) and account settings.
• Where we need to verify you before accepting an entry or releasing
  a prize: a copy of photo identification, proof of address, and
  proof of age.

3.2 Competition Entries

We may collect:

• Which competitions you entered, how many entries you hold, your
  entry numbers, and your answers to competition questions.
• Whether the entry was paid or made through the free entry route.
• Draw results and, where you win, records relating to prize
  verification and delivery.

3.3 Payments and Account Credit

We may collect:

• Transaction records, including amount, date, currency and the
  outcome of the payment.
• Account credit and promotional credit balances and movements,
  discount codes used, and referral activity.
• We do not store your full card number. Card details are entered
  directly with our payment provider.

3.4 Contact With Us

We may collect:

• Messages you send us by email, live chat, WhatsApp or social media,
  and our replies.
• Notes we make when handling a query, complaint or account
  restriction request.

3.5 Responsible Participation

We may collect:

• Any restriction you set on your own account, when you set it,
  and when it is lifted.
• Where you tell us you are spending more than you intended, a record
  of that and of the action we took.

3.6 Technical and Usage Information

We may collect:

• IP address, device type, browser, operating system and general
  location derived from your IP address.
• Pages you visited, what you clicked, and how you arrived at the Website.
• Cookie and similar identifiers — see Section 7.

4. Where We Get Your Information From

Most of the information we hold comes directly from you — when you
register, enter a competition, enter by post, make a payment, or
contact us.

We may also receive some information from others, including:

• Our payment provider, which tells us whether a payment succeeded
  or failed and may provide limited card details such as the last
  four digits and card type.
• Our website and analytics tools, which generate technical
  information about your visit.
• Social media platforms, where you interact with us and the platform
  makes information available to us.
• Identity or age verification providers, where we carry out identity
  or age checks.

5. Why We Use Your Information and Our Legal Basis

We only use your personal information where the law allows us to.
In most cases, this is because we need it to provide the service you
have asked for, because we have a legitimate interest in running our
business responsibly, because we have a legal obligation, or because
you have given consent.

Where we rely on legitimate interests, we have considered whether
those interests are outweighed by your rights and freedoms.

You can ask us for more detail on that assessment, and you can object
— see Section 11.

6. Marketing

We may send you information about upcoming competitions, prizes and
offers by email or SMS where you have agreed to receive it, or where
you have entered a competition with us and we are permitted to contact
you about similar competitions.

You can stop marketing at any time by:

• Using the unsubscribe link in an email;
• Replying STOP to an SMS;
• Changing your marketing preferences in your account; or
• Contacting us by email.

We will action your request promptly and keep a record of your objection
so that we do not contact you again by mistake.

Opting out of marketing does not stop service messages that we need
to send you about your account, an entry, a competition or a prize.

We do not sell your personal information to third parties.

7. Cookies and Similar Technologies

We use cookies and similar technologies to:

• Keep you logged in;
• Remember what is in your basket;
• Understand how the Website is used; and
• Measure our advertising.

Cookies that are strictly necessary for the Website to work are set
automatically.

All other cookies — including analytics and advertising cookies —
are only set if you agree through our cookie banner.

You can change or withdraw your choice at any time using:

the cookie settings control available on the Website

Full details of the cookies we use are available in our:

the Highland Vault Cookie Policy available on the Website

8. Who We Share Your Information With

We share personal information only where it is necessary, and only
with organisations that are required to protect it and to use it
solely for the purposes for which we provide it.

If our business is sold or reorganised, personal information may be
transferred as part of that transaction. Where required, you will be
informed before this happens.

9. Sending Information Outside the EEA

We are based in the United Kingdom, so your information may be
transferred from Ireland to the UK and stored and processed there.

On 19 December 2025, the European Commission renewed its decision
that the United Kingdom provides an adequate level of protection for
personal data. That decision runs until 27 December 2031 and means
no additional safeguard is needed for these transfers.

Some of the providers listed in Section 8 may process information
outside the EEA and the UK.

Where they do, we rely on either an adequacy decision covering that
country or standard contractual clauses approved by the European
Commission, together with any additional measures the transfer requires.

You can ask us for a copy of the safeguards we rely on for any
particular transfer.

10. How Long We Keep Your Information

We keep personal information only for as long as we need it. Once it
is no longer required, we will delete it or anonymise it.

Where a dispute, investigation or legal claim is ongoing, we may keep
relevant information until it is resolved.

11. Your Rights

Under the GDPR, you have the following rights. Some of these rights
apply only in certain circumstances, and we will explain if a right
does not apply to your request.

Access

You can ask for a copy of the personal information we hold about you.

Rectification

You can ask us to correct inaccurate information or complete incomplete
information.

Erasure

You can ask us to delete your information where we no longer have a
good reason to keep it.

Restriction

You can ask us to pause our use of your information while a concern
is being resolved.

Objection

You can object to our use of your information where we rely on
legitimate interests.

You can object to direct marketing at any time and we will stop
sending it to you.

Portability

You can request the information you provided to us in a common
machine-readable format, or ask us to send it to another provider
where applicable.

Withdraw Consent

Where we rely on your consent, you can withdraw that consent at any time.

This does not affect anything we did before you withdrew your consent.

Exercising these rights is free.

We may ask you to confirm your identity first so that we do not
disclose your information to someone else.

Some rights have limits. For example, we may need to keep records of
your entries, payments and draw results even after you close your
account because we may be legally required to do so and because we
may need them to evidence that a competition was run fairly.

12. How to Exercise Your Rights

You can exercise your rights by emailing:

info@highlandvault.com

You may also write to us at:

TVI Fife Limited, trading as Highland Vault
3 Castle Street
Carnegie Campus
Dunfermline
Scotland
KY11 8PB

Please tell us what you would like us to do.

We will respond within one month.

If your request is complex, or you have made several requests, we may
extend this period by up to two further months. If this happens, we
will tell you within the first month and explain why.

13. Complaining to the Data Protection Commission

If you are unhappy with how we have handled your personal information,
please tell us first so that we have the opportunity to put things right.

You also have the right to complain to the Irish supervisory authority
at any time:

Data Protection Commission
6 Pembroke Row
Dublin 2
D02 X963
Ireland

Website:

www.dataprotection.ie

Email:

info@dataprotection.ie

Complaints can be made in writing, through the Commission’s webform
or by email.

Complaining to us first does not affect your right to complain to the
Data Protection Commission.

14. Keeping Your Information Secure

We use technical and organisational measures to protect your personal
information, including:

• Encryption of the connection between your browser and our Website;
• Encrypted storage of passwords;
• Access controls limiting who can see customer data; and
• Regular software updates.

No system is completely secure.

If a data breach occurs that is likely to result in a high risk to
your rights and freedoms, we will tell you without undue delay and
explain what happened and what you should do.

Please keep your password confidential and use a password that you
do not use anywhere else.

15. Age Restriction

Our competitions are for adults aged 18 or over,
and our Website is not intended for anyone under 18.

We do not knowingly collect information from anyone under 18.

If we discover that an account belongs to someone under 18, we will
close the account, invalidate any entries and delete the information
we hold, keeping only the minimum record necessary to prevent the
account from being reopened.

If you believe that a person under 18 has provided us with their
personal information, please contact us and we will deal with the
matter appropriately.

16. Automated Decisions and Profiling

We use automated checks to help detect:

• Duplicate accounts;
• Fraudulent payments;
• Attempts to get around entry limits; and
• Other potentially abusive activity.

These checks may flag an account for review, but a person makes the
decision before any account is suspended or any entry is invalidated.

We may group customers according to how they have used the Website
in order to decide which competitions to tell them about.

This profiling has no legal or similarly significant effect on you,
and you can object to it at any time.

We do not make decisions that produce legal effects for you, or
similarly significantly affect you, based solely on automated processing.

Draw results are selected at random and are not based on any profile
of you.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our services,
systems or the law.

The current version will always be published on the Website with
its effective date.

Where a change materially affects how we use your personal information,
we will tell you directly before the change takes effect where required.

18. How to Contact Us

For anything relating to your personal information or this Privacy
Policy, please contact:

TVI Fife Limited
Trading as Highland Vault

Company Number: SC844459

Registered Office:
3 Castle Street
Carnegie Campus
Dunfermline
Scotland
KY11 8PB

Email:

info@highlandvault.com

Website:

https://highlandvault.com

For general customer service, please use the contact details shown
on the Highland Vault Ireland Website.