Privacy Policy

1. Who We Are

Interlink Digital Group Limited ("Plush Rush", "we", "us") is the data controller for personal data collected through plushrush.com. Company number: 05431902. Registered address: 27 Old Gloucester Street, London, WC1N 3AX. Contact: support@plushrush.com.

2. What Data We Collect

• Account data: Name, email, date of birth, password (hashed)
• Transaction data: Payment amounts, entry history, payment reference ID
• Address data: Delivery address for prize fulfilment (when provided)
• Technical data: IP address, browser type (for security and fraud prevention)
• Communication data: Email preferences, support correspondence

We do not collect or store your full card number. All payment processing is handled by our PCI DSS-compliant payment provider.

3. Lawful Basis for Processing

• Contract: Processing your entries, payments, and prizes
• Legitimate interest: Fraud prevention, security, platform improvement
• Consent: Marketing emails (opt-in only)
• Legal obligation: Financial records, age verification, regulatory compliance

4. How We Use Your Data

We use your data to: operate your account and process entries; communicate draw results and account notifications; prevent fraud and ensure platform security; comply with legal and regulatory requirements; and send marketing communications if you've opted in.

5. Analytics

We use Plausible Analytics, a privacy-focused, cookie-free analytics tool hosted in the EU. Plausible does not collect personal data, does not use cookies, and does not track users across websites. No consent is required for Plausible under GDPR or ePrivacy regulations.

6. Data Sharing

We share data only with:

• Payment provider: Payment processing (PCI DSS compliant)
• Postmark: Transactional email delivery (US-based, GDPR compliant)
• Prize suppliers: Delivery address for prize fulfilment only

We do not sell your personal data. We do not share data with social media platforms or advertising networks.

7. Data Retention

• Account data: retained while your account is active, deleted within 30 days of account deletion
• Financial records: retained for 7 years (legal requirement)
• Marketing consent: retained until you withdraw consent

8. Your Rights

Under UK GDPR, you have the right to: access your data; rectify inaccurate data; erase your data (subject to legal obligations); restrict processing; data portability; object to processing; and withdraw consent. To exercise any of these rights, email support@plushrush.com. We will respond within 30 days.

9. Cookies

We use only essential cookies for session management and CSRF protection. We do not use tracking cookies. See our Cookie Policy for details.

10. Security

We implement industry-standard security measures including HTTPS encryption, bcrypt password hashing, CSRF protection, rate limiting, and regular security audits. Your payment data is processed by our payment provider and never touches our servers.

11. Complaints

If you're not satisfied with how we handle your data, you can lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

12. Changes

We may update this policy from time to time. Material changes will be communicated via email. Continued use of the platform constitutes acceptance of the updated policy.