A prize draw that stands up.

Country Estate & Venue

Client

Country Estate & Venue

Sector

Hospitality & Leisure

Discipline

Data & Automation

Outcome

A competition entry that would survive a complaint

Client name withheld for confidentiality.

The problem on the table.

A prize draw is the cheapest way a hospitality business can build a marketing list, and it is also the easiest place to collect personal data badly. The temptation is to ask for everything while the entrant is motivated, tick the consent boxes by default, and settle the lawful basis later.

The regulator's requirement is specific and awkward. A controller has to be able to demonstrate what an entrant actually agreed to, and a flag in a database recording that a box was ticked does not do that, because it does not record what the box said at the moment it was ticked.

There was also a fair commercial question to answer: who is actually entering. The usual way of answering it, collecting data under one description and quietly using it for another, is precisely what the rules exist to prevent, so it had to be answered another way.

What forensic looked like here.

The consents were separated into the things they genuinely are. Email, text message and post are different channels under different rules and are asked for separately. Quoting an entrant's answer publicly is a different permission again, as is passing details to a named sister company. None is pre-ticked, none is required to enter, and none is bundled with another.

The exact sentence shown on the page is recorded with each answer at the moment of submission, so the record is what was agreed to rather than that something was. An unticked box records a decline rather than an absence, because shown-and-declined and never-asked are different facts.

The commercial question was answered by asking things an entrant volunteers rather than by collecting data that would need a second justification. A few short questions about the occasion, and about where they have enjoyed staying before, separate the field far better than asking anyone what they earn. The page states honestly that this ranks entrants on what they choose to tell you, which is an inference and never a measurement.

Location was reduced to the broad postcode area and framed on the page as where the entrant would travel from, which is what it is actually for. A field collected for one stated purpose and quietly used for another is precisely what the rules exist to prevent.

The page carries no analytics at all. Anything that profiles a visitor needs its own permission, and a competition entry page is the wrong surface on which to ask for a second thing.

• Separate, unticked, unbundled consents by channel and by purpose
• The exact consent wording recorded with each answer at submission
• A decline recorded as a decline, distinct from never having been asked
• Broad location only, described on the page by the purpose it serves
• A self-contained page with no analytics and one external request

What changed.

The entry page is built and ready to hand over: it collects what the marketing genuinely needs, records permission in a form that could be produced if it were ever questioned, and asks for nothing it cannot justify on the page itself.

Every claim about the page was measured in a real browser rather than assumed: no sideways scrolling at any phone width, every control large enough to hit, and every word legible against the surface behind it. Facts the client had not yet supplied are visibly marked as unconfirmed rather than filled in with something plausible.

• 6 consentsseparate, none pre-ticked
• Wordingrecorded with the answer
• Declineddistinct from never asked
• Mobile firstmeasured, not assumed

Other engagements.