Legal & Compliance

Legal Framework

Win Luxury Club Ltd operates a skill-based competition platform. Participants answer a skill question and are entered into a prize draw. The business model falls outside the Gambling Act 2005 by virtue of the skill element and the mandatory free postal entry route.

Legal classification

The Company's operations are classified as:

• Skill-based competitions (not gambling);
• Prize promotions under the Consumer Protection from Unfair Trading Regulations 2008;
• E-commerce services under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013;
• Data processing under the UK GDPR and the Data Protection Act 2018.

Document hierarchy

In the event of conflict between documents, the following hierarchy applies: (1) applicable law; (2) Terms & Conditions; (3) Competition Rules; (4) the specific policies set out in Sections 4–16.

Terms & Conditions

2.1 Definitions

“Platform” means the website operated by Win Luxury Club Ltd. “User” means any registered individual. “Competition” means a skill-based contest. “Free Entry” means a no-purchase entry route. “Draw” means the random selection of a winner. “Prize” means any item or award offered by the Company.

2.2 Eligibility

To participate, Users must: (a) be aged 18 or over; (b) be resident in an eligible jurisdiction; (c) hold a valid registered account; (d) not be an employee, agent, director or immediate family member of the Company. Valid ID may be requested for prize claims. Residents of restricted territories are excluded.

2.3 Registration

Users must register with accurate and complete information. The Company reserves the right to verify all details. Any false information may result in immediate account suspension and forfeiture of any prizes.

2.4 Account security

Users are responsible for keeping their login credentials confidential. The Company accepts no liability for unauthorised access resulting from User negligence and must be notified immediately of any suspected unauthorised use.

2.5 Intellectual property

All content on the Platform is the exclusive property of Win Luxury Club Ltd or its licensors. Unauthorised reproduction or use is strictly prohibited.

2.6 Amendments

The Company may amend these Terms at any time. Users will be notified of material changes by email; continued use following notification constitutes acceptance.

2.7 Payments

All payments are processed securely through authorised payment providers. Entry fees are charged at the point of purchase and are non-refundable once the competition has commenced.

2.8 Governing law

These Terms are governed by and construed in accordance with the laws of England and Wales. Any disputes are subject to the exclusive jurisdiction of the courts of England and Wales.

2.9 Severability & 2.10 Entire agreement

If any provision is found invalid or unenforceable, the remaining provisions continue in full force and effect. These Terms, together with all applicable policies, constitute the entire agreement between the User and the Company.

2.11 Language

These Terms are provided in English and French and both versions are equally authoritative. For Users resident in a francophone jurisdiction (e.g. France, Belgium), the French-language version governs to the extent required by mandatory local consumer-protection law; no clause designating another language as prevailing may operate to the detriment of such a consumer.

Competition Rules

These Rules govern the entry, conduct and outcome of all competitions on the Platform. By entering, Users agree to be bound by these Rules in addition to the general Terms & Conditions.

3.2 Competition structure

Each competition specifies: (a) the prize on offer; (b) the maximum number of entries; (c) the entry fee (if applicable); (d) the closing date; (e) the skill question and correct answer; (f) the free entry route.

3.3 Skill element

All competitions require the correct answer to a skill-based question as a condition of entry. The question is designed to be answerable by a person of ordinary intelligence. Entries with incorrect answers are not eligible for the draw.

3.4 Equal treatment

All eligible entries — whether paid or free — are treated equally in the draw. No entry is given preferential weighting based on the method of entry or the amount paid.

3.5 Entry limits

A maximum number of paid entries per User per competition may apply, as specified on the competition page. Free entry is limited to one entry per competition per User. Multiple accounts used to circumvent this limit result in disqualification.

3.6 Draw mechanism

Winners are selected by a certified, externally auditable random number generator. The Company uses RANDOM.ORG, relying on both its public Third-Party Draw Service record and its cryptographically Signed API, so that every result is independently verifiable. Any change of RNG tool is announced at least 30 days in advance.

Paid entries (submitted on the Platform) and free entries (submitted by post) form a single, common pool, indexed sequentially from 1 to N with no distinction or weighting — one postcard equals one entry, exactly as one paid ticket equals one entry. At competition close the pool is frozen: a snapshot is taken and a SHA-256 commitment hash of that snapshot is published before the draw is run.

The draw requests integers in the range [1, N], drawn without replacement, returning in a single call one winner and three substitutes. The mapping from drawn number to entry is deterministic (based on timestamp and entry ID) and can be recalculated identically by an independent third party. Each draw is logged with a full audit trail (timestamp, number of eligible entries, seed/signature, winner and substitute entry IDs). The published RANDOM.ORG certificate together with the anonymised snapshot allow public verification in under 10 minutes. Draw logs are retained for a minimum of six (6) years on immutable (WORM) storage.

3.7 Winner notification & substitution

Winners are notified by email within 48 hours of the draw and must respond within 14 days to claim their prize. Where a winner fails to respond within that period or is found ineligible, the prize passes to the first substitute drawn in the same draw, then to the second and third substitutes in order. A fresh draw (redraw) is used only exceptionally, where the winner and all three substitutes are unavailable, and is itself logged and verifiable.

3.8 Prize delivery & substitution

Prizes are delivered in accordance with Section 11. The Company may substitute a prize of equal or greater value where the stated prize is unavailable due to circumstances beyond its control.

Free Entry Policy

The free entry route ensures that the Company's competitions fall outside the definition of a lottery under the Gambling Act 2005. This route is genuine, accessible and treated equally to paid entries.

4.2 Accessibility

The free entry route is permanently available throughout each competition's duration, via the Platform or by postal request. No purchase, payment or commercial activity is required.

4.3 Equal treatment

Free entries are pooled with paid entries before the draw. The draw mechanism makes no distinction between the two. Any competition where free entries are treated differently or excluded is considered void.

4.4 Processing timeframe & postal window

Free entries submitted via the Platform are processed immediately and confirmed by automated email. Postal free entries must be received no later than the competition close; entries received by that deadline are keyed in during a short capture window, after which the common pool is frozen and the commitment hash published (Section 3.6). Every valid entry received before close — paid or free — is therefore included in the draw on an equal footing.

4.5 Postal entry route

Users may submit a free entry by sending a postcard to the Company's registered address, including: full name, date of birth, email address, the competition reference and the answer to the skill question. One postcard equals one entry.

4.6 Audit & 4.7 Limitation

The Company maintains a complete log of all free entries received, processed and included in each draw, available for inspection by authorised regulatory, banking or PSP representatives. One free entry is permitted per User per competition; attempts to submit multiple free entries using different identities are treated as fraud and may result in disqualification and account suspension.

Privacy Notice (UK GDPR)

5.1 Data controller

The data controller is Win Luxury Club Ltd (Companies House No. 17240690), 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, registered in England and Wales. Data-protection enquiries: contact@saga-insiders.club. The Company will register with the Information Commissioner's Office (ICO) as required by the Data Protection Act 2018 and UK GDPR before any live data processing; the ICO registration number will be inserted here on completion.

5.2 Legal bases

• Contract — necessary to provide Platform services;
• Legal obligation — AML, fraud prevention and HMRC compliance;
• Legitimate interest — fraud detection and platform security;
• Consent — marketing communications, withdrawable at any time.

5.3 Categories of data

Identity data (name, date of birth, government-issued ID); contact data (email, phone, postal address); transaction data (payment records, entry history); technical data (IP address, device information, cookies); verification data (KYC documents, AML screening results).

5.4 Retention

• Financial & HMRC data — 6 years from end of fiscal year;
• KYC/AML records — 6 years from prize delivery (remise) or from end of business relationship, whichever is later;
• Competition records — 6 years from draw date;
• Marketing data — 3 years from last interaction;
• Technical logs — 12 months from creation;
• Complaints & legal records — 6 years from resolution.

5.5 User rights

Under UK GDPR, Users may access, rectify, erase, restrict or object to processing of their data, request portability and withdraw consent at any time. Requests to contact@saga-insiders.club; response within 30 days.

5.6–5.8 Security, sharing & transfers

The Company applies appropriate technical and organisational measures (encryption, secure storage, role-based access, audits, staff training, incident response). Data may be shared with payment processors, KYC/AML providers, legal and regulatory authorities and professional advisers — and is never sold to third parties. International transfers are protected by Standard Contractual Clauses or equivalent ICO-approved measures.

5.9 Complaints to the ICO

Cookie Notice

This notice explains how the Company uses cookies and similar technologies (tracking pixels, web beacons, local storage, session identifiers) on the Platform, for all visitors, users and devices.

6.3 Types used

Strictly necessary (functionality, security, login sessions); performance (usage analysis); functional (preferences); marketing (behaviour tracking and targeted content).

6.4 Legal basis

Strictly necessary cookies are deployed without consent on the basis of legitimate interest. All non-essential cookies require prior, explicit and informed consent in accordance with UK PECR and UK GDPR.

6.5 Consent management

The Company implements a compliant Consent Management Platform (e.g. Cookiebot or OneTrust). Consent logs are retained for a minimum of three (3) years and available for ICO audit.

6.6–6.7 Management & third parties

Users may accept or reject non-essential cookies via the CMP banner, change preferences at any time and withdraw consent without detriment; browser settings may also be used. Third-party cookies (analytics, advertising, payment) are limited to GDPR-compliant providers with access strictly necessary.

Age, KYC & AML Policy

This Policy sets out the Company's obligations for age verification, KYC and AML controls under the Proceeds of Crime Act 2002, the Money Laundering Regulations 2017 and applicable FCA guidance.

7.2 Age verification

All Users must confirm they are aged 18 or over at registration. The Company may request documentary evidence of age at any time; failure to provide it may result in account suspension and forfeiture of prizes.

7.3 KYC verification

KYC checks are conducted for all Users prior to prize delivery and for high-value or high-frequency transactions. Documents may include government-issued photo ID, proof of address dated within 3 months, and a source-of-funds declaration for high-value prizes. KYC records are retained for 6 years from prize delivery.

7.4 Customer due diligence

A risk-based approach applies: standard CDD for all Users; Enhanced Due Diligence (EDD) for high-risk profiles, PEPs and high-value transactions; simplified CDD where permitted.

7.5 AML controls

Ongoing transaction monitoring detects suspicious activity (unusual patterns, inconsistencies, multiple accounts, geographic risk). Suspicious activity is reported to the National Crime Agency (NCA) via a SAR where required. Records are retained for a minimum of 6 years and available to the NCA, HMRC, FCA and other competent authorities. Relevant staff receive mandatory AML/KYC training on joining and annually.

Anti-Fraud & Multi-Account Policy

8.2 Definition

Fraud includes use of stolen payment credentials, creation of multiple accounts to circumvent entry limits, use of bots or automated tools, identity theft, collusion between Users and manipulation of the competition or draw process.

8.3 Single account rule

Each User is permitted one registered account only. The Company uses device fingerprinting, IP tracking and behavioural analysis to detect multiple accounts. Any User operating more than one account has all accounts suspended and all entries forfeited.

8.4–8.6 Detection, investigation & consequences

Automated tools analyse transaction velocity, device/IP anomalies, geographic inconsistencies, payment-method risk and behavioural patterns; alerts are reviewed within 24 hours. On suspected fraud the Company may suspend accounts, freeze prize delivery, request additional verification, and escalate to law enforcement. Confirmed fraud may result in a permanent ban, forfeiture of entries and prizes, recovery of funds and referral to the NCA.

Fraud investigation records are retained for a minimum of 6 years and available for audit by banks, PSPs and regulators. See Section 9 for chargeback evidence.

Refund & Anti-Chargeback Policy

9.2 No-refund policy

All entry fees are non-refundable once a competition entry has been processed, save for the cases set out in Section 9.6. By completing their entry, Users expressly consent to immediate performance of the service and waive their right of withdrawal under the Consumer Contracts Regulations 2013, Art. 36(1)(a).

9.3 Chargeback evidence package

For each transaction the Company retains: entry confirmation with timestamp; IP address and geolocation; device fingerprint; T&C acceptance log (timestamp + version); KYC verification status; email confirmation record; skill question and answer record.

9.4–9.5 Response & monitoring

On a chargeback notification the Company compiles the full evidence package within 48 hours, submits a structured rebuttal to the acquirer/PSP, flags the account for fraud review and suspends future entries pending resolution. Chargeback ratios are monitored daily; if a PSP/scheme threshold is exceeded, an immediate remediation plan is implemented and the PSP notified proactively.

9.6 Refund cases

By way of exception to the no-refund principle, a full refund is issued in the following cases:

• an incorrect answer to the skill question, where the entry is therefore not eligible for the draw;
• a paid entry that exceeds the maximum number of tickets permitted per User for the competition;
• a payment completed outside the secure checkout window (the 60-second “sas”), where the entry could not be validly registered.

In addition, the Company may at its discretion refund a proven technical error preventing a valid entry, a duplicate-payment error, or where a competition is cancelled before the draw.

Responsible Participation Policy

Core principles: transparency, fairness, user awareness and non-exploitative practices.

10.2 Non-gambling statement

Participation on the Platform does not constitute gambling, does not involve wagering and is not based solely on chance. The Company is not licensed as a gambling operator and does not operate under the Gambling Act 2005.

10.3–10.4 Awareness & spending controls

Users are clearly informed about how the Platform operates, the nature of skill-based competitions, the absence of guaranteed winnings, the free entry route and responsible spending. The Platform may provide optional voluntary limits and alerts, and the Company may intervene where abnormal patterns are detected.

10.5 Self-exclusion

Users may request temporary suspension or permanent closure at any time via contact@saga-insiders.club; requests are processed within 24 hours.

10.6 Vulnerable users

The Company may identify vulnerable users through behavioural indicators and take protective action (communication, restriction or suspension). Concerns may be raised at contact@saga-insiders.club.

Winner Selection, Audit & Prize Delivery

11.2 Draw integrity

All draws use a certified RNG (RANDOM.ORG Signed API), run after competition close and after the postal-entry capture window has closed (Section 3.6 and 4.4). At close the common pool is frozen and a SHA-256 commitment hash of the snapshot is published before the draw. Each draw returns one winner and three substitutes in a single call.

The level of independent control is proportionate to the value of the lot:

• Entry-level lots — signed log retained only;
• Mid-tier lots — signed log plus video recording of the draw;
• High-value lots — attendance of an independent witness;
• Exceptional lots — live broadcast plus full third-party audit.

11.3 Audit trail

Each draw produces a complete audit log: competition ID and name; draw date/time (UTC); total eligible entries; entries included (paid and free); the SHA-256 commitment hash of the frozen pool snapshot; RNG signature/seed and algorithm; winner entry ID and the three substitute entry IDs, with account references. The RANDOM.ORG certificate and an anonymised snapshot are published so any third party can reproduce the result in under 10 minutes. Logs and the audit file are retained for 6 years on immutable (WORM) storage; the detailed operating procedure is held internally and is auditable on request.

11.4–11.5 Verification & delivery

Before delivery, the winner must complete age verification (18+), KYC identity checks, confirmation they are not an excluded person, and acceptance of delivery terms. Prizes are delivered within a reasonable timeframe following verification, typically within 30 days, coordinated with the winner and documented.

11.6–11.7 Substitution & announcement

Where the stated lot becomes unavailable, the Company may either substitute a lot of equal or greater monetary value or, where this has been announced in advance for the competition, settle by a bank transfer equal to the lot's value. Such a monetary alternative is lawful in the UK; for the French market it is subject to the reserve set out below and to prior confirmation by qualified counsel. Winners may be announced publicly subject to consent; where consent is withheld, the winner remains anonymous and the Company may confirm on request that a valid winner was selected.

Complaints & ADR Policy

12.2–12.3 Submission & four-level handling

Complaints are submitted to contact@saga-insiders.club with full name, account reference, a description of the issue and supporting documents. Handling follows a four-level path:

• Level 1 — first response. Acknowledgement within 2 business days and a formal response within 14 calendar days.
• Level 2 — internal escalation. If the User is dissatisfied, the matter is escalated to management for a final internal decision within 30 calendar days.
• Level 3 — alternative dispute resolution. If still unresolved, the User may refer the matter to an independent ADR body / mediator appropriate to their market (see Section 12.5).
• Level 4 — courts. The User retains the right to bring proceedings before the competent courts.

12.5 Alternative Dispute Resolution

At Level 3, Users may refer the matter to an independent ADR body. For UK consumers the designated body is CEDR; for francophone markets a locally competent mediator will be designated in the francophone-market addendum (e.g. the relevant consumer mediator in France/Belgium), so that each User is offered an ADR route appropriate to their jurisdiction.

All complaints, responses and outcomes are documented and retained for a minimum of 6 years. This Policy aligns with the Consumer Rights Act 2015 and the ADR Regulations 2015.

Liability, Disclaimer & Force Majeure

13.2 Limitation of liability

To the fullest extent permitted by law, the Company's aggregate liability to any User shall not exceed the total amount paid by that User in the 12 months prior to the event giving rise to the claim. The Company is not liable for indirect or consequential losses, loss of profit, loss of data, or losses arising from events outside its reasonable control.

13.3 Statutory rights

Nothing in these Terms limits or excludes the Company's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any liability that cannot be excluded by law under the Consumer Rights Act 2015.

13.4–13.6 Availability, third-party links & force majeure

The Company does not warrant uninterrupted or error-free availability and will use reasonable endeavours to restore service promptly. It is not responsible for third-party websites linked from the Platform. The Company is not liable for failure or delay caused by events beyond its reasonable control (acts of God, pandemic, war or civil unrest, government action, failure of third-party infrastructure) and will notify Users and seek to resume normal operations.

Marketing, Influencer & Advertising Compliance

14.2 Regulatory compliance

All marketing complies with the UK Code of Non-broadcast Advertising (CAP Code 2010, 12th Edition) and ASA guidelines, the Consumer Protection from Unfair Trading Regulations 2008 and UK GDPR/PECR for direct marketing.

14.3–14.6 Transparency & responsible advertising

Promotions clearly state entry conditions and cost, free entry availability and route, the closing date, prize description and estimated value, and any significant conditions. Marketing must not exaggerate chances of winning, guarantee outcomes, present competitions as gambling or pure luck, or target audiences under 18 or vulnerable individuals. Influencers and affiliates must disclose their commercial relationship and comply with Meta, TikTok and Google Ads policies (under-18 audiences excluded).

Payment Provider & Banking Compliance

15.2 Business model

Win Luxury Club Ltd operates skill-based competitions (not gambling) with a mandatory free entry route. The Company is not a gambling operator and is not required to hold a Gambling Commission licence. Revenue is generated from entry fees, and transactions are clearly described on all payment receipts.

15.3 Transaction descriptors

15.4 Accepted payment methods

Major debit and credit cards (Visa, Mastercard); digital wallets where permitted; bank transfers for high-value prizes. All processing is PCI-DSS compliant. No cryptocurrency payments are accepted.

15.5–15.7 Risk management & PSP cooperation

Chargeback rates are kept below PSP thresholds through clear descriptors, explicit T&C acceptance at checkout, comprehensive evidence packages, proactive fraud monitoring and rapid dispute response (Section 9). The Company provides PSPs with full business-model documentation, this Legal Pack, KYC/AML documentation, financial projections and chargeback procedures, and cooperates fully with due-diligence requests. It does not process payments for third parties and does not operate as a payment intermediary.

Internal Compliance Checklist

16.2 Compliance Officer

The Compliance Officer (contact@saga-insiders.club) oversees all compliance activities, maintains this checklist, liaises with banks, PSPs and regulators, and escalates issues to the Board.

16.3 Contact directory

16.4 Applicable legal framework

• Gambling Act 2005
• Proceeds of Crime Act 2002
• Money Laundering Regulations 2017
• UK GDPR & Data Protection Act 2018
• Consumer Rights Act 2015
• Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013
• Alternative Dispute Resolution for Consumer Disputes Regulations 2015 (SI 2015/542)
• UK Code of Non-broadcast Advertising (CAP Code 2010, 12th Edition)
• Companies Act 2006

16.5 Operational controls

Daily, weekly, monthly, quarterly and annual controls cover transaction monitoring, free-entry availability and processing logs, chargeback monitoring, fraud review, KYC verifications, marketing compliance, board reporting, PSP relationship reviews, data-retention reviews, internal and external audits, DPIA, ICO registration renewal and staff AML/KYC training.

16.6 Audit evidence package

Maintained and available for inspection at all times: this Legal Pack (all 16 sections); draw audit logs; KYC/AML records; transaction logs; chargeback evidence packages; marketing compliance records; staff training records; ICO registration certificate; board compliance reports.

16.7 Status register — confirmed vs outstanding

Confirmed and inserted: Companies House No. 17240690; legal form (private company limited by shares); date of incorporation (25 May 2026, Cardiff); registered office (71–75 Shelton Street, WC2H 9JQ); share capital (£2.00); directors/signatories (R. Zerath, B. Blanco); PSC (each >25% and ≤50%); single contact (contact@saga-insiders.club); hosting provider (OVHcloud, Roubaix).

Outstanding before publication / go-live:

• Operational free-entry postal address (processable within 48h; may differ from the registered office);
• ICO registration number;
• Designation of a Data Protection Officer (DPO);
• Designation of a publication director (mentions légales);
• VAT number (if/when liable);
• “Members Club” subscription terms (a service distinct from the competitions);
• Founding ambassador-programme terms (to be drafted with an art. L322-1 opinion);
• Francophone-market compliance addendum (loi du 9 juin 2023, art. L322-1, ANJ, ARPP) and localised terms for BE/CH/QC.