1. Who we are

Intercontinental Brands (ICB) Ltd is the data controller responsible for the personal information collected through this competition.

The competition website has been designed, developed and operated on behalf of Intercontinental Brands (ICB) Ltd by Kerve Creative Limited (“Kerve”). Kerve acts as a data processor and processes your personal information on behalf of Intercontinental Brands for the purposes of administering the competition.

If you have any questions about how your personal information is used, or wish to exercise your data protection rights, please contact:

Intercontinental Brands (ICB) Ltd
Privacy contact: dataprotection@fortitudespirits.com

2. The competition

Competition: COSTA RICA SEA TURTLE CONSERVATION ADVENTURE

Prize: There is one prize for one winner and one guest: a Costa Rica sea turtle conservation adventure for two, with a total maximum value of £8,000.

Competition dates: The competition opens at 00:01 on 1 October 2026 and closes at 23:59 on 31 January 2027

The competition is open to residents of England, Scotland and Wales aged 18 or over. An age verification step is used on the competition website before an individual can proceed to enter.

Full competition eligibility requirements, entry conditions and winner selection arrangements are set out in the separate Competition Terms & Conditions.

3. What personal information do we collect?

When you enter the competition, we may collect:

• Your full name
• Your email address
• Your answer to the competition question
• An image uploaded as proof of purchase
• Your marketing preferences, where you choose whether or not to receive marketing communications

We may also process limited technical information associated with your use of the website, such as information relating to your visit, submission and website security.

Server-side visitor information may be collected through the website infrastructure and shared with Intercontinental Brands for website and competition reporting purposes. This information is used to understand overall website visitor numbers and does not form part of your competition entry.

4. How will we use your personal information?

Your personal information will be used to:

• Process and administer your competition entry
• Verify your eligibility to enter
• Check your proof of purchase where required
• Assess and manage competition entries
• Help prevent fraudulent, duplicate or otherwise invalid entries
• Select and contact the competition winner
• Arrange fulfilment of the prize
• Respond to queries relating to the competition
• Maintain appropriate records relating to the competition
• Operate and protect the competition website
• Comply with applicable legal and regulatory obligations

Your uploaded proof-of-purchase image may also be checked using third-party image safety and moderation services to help identify prohibited or inappropriate content and maintain the integrity and safety of the competition.

Marketing

If you separately choose to opt in to receive marketing communications, Intercontinental Brands may use your name and email address for ongoing marketing communications, including information about Intercontinental Brands, its products, offers, news and other information that may be of interest to you.

Entering the competition is not conditional on agreeing to receive marketing communications.

Your marketing preference will be recorded separately from your competition entry.

5. Our lawful basis for using your information

Under applicable data protection law, we must have a lawful basis for collecting and using your personal information.

Depending on the purpose, Intercontinental Brands may rely on the following lawful bases:

Administration of the competition: Processing is necessary to administer your competition entry and fulfil the arrangements associated with the competition.

Legitimate interests: Processing may be necessary for legitimate interests such as operating and protecting the competition, preventing fraud or misuse, maintaining appropriate records and managing the website, provided that these interests are not overridden by your rights and interests.

Consent: Where you have chosen to opt in to receive marketing communications, your consent provides the lawful basis for using your personal information for those marketing purposes.

Where we rely on your consent, you can withdraw your consent at any time.

6. Who will have access to your information?

Your personal information will only be shared with organisations and individuals who need it for the purposes described in this Privacy Notice.

Kerve Creative Limited

Kerve Creative Limited operates the competition website and processes competition entry information on behalf of Intercontinental Brands.

Kerve will securely hold your competition entry information during the competition period. Following the competition closing date, Kerve will transfer the relevant competition data to Intercontinental Brands.

Once the transfer has been successfully completed, Kerve will delete the competition entry data from its active systems.

Kerve does not retain competition entry data for its own marketing purposes.

Technology and service providers

Kerve uses trusted technology and service providers to operate the competition website and securely process competition entries. These include:

• Vercel – website hosting and related technical infrastructure
• DigitalOcean – hosting of the application server, database and image storage
• Microsoft PhotoDNA – image hash checking to help identify known prohibited content
• Sightengine – image safety and moderation checks

These providers process information only as necessary to provide their relevant services and subject to appropriate contractual and data protection arrangements.

7. Proof-of-purchase images and image safety checks

Images uploaded as part of your competition entry are stored securely and may be checked using image safety and moderation technologies.

Automated image safety checks

Where enabled, uploaded images are subject to automated safety and moderation checks before they are stored or made available through our services. These checks may result in an image being rejected. The checks are automated and may be supplemented by manual review where appropriate.

Microsoft PhotoDNA

Where PhotoDNA checking is enabled, a PhotoDNA hash may be supplied by the application submitting the image. We send this hash, rather than the original image file, to Microsoft’s PhotoDNA Cloud Service to compare it with hashes associated with known child exploitation images.

The hash is a non-reversible digital signature and cannot be used to recreate the original image. The original image file is not sent to Microsoft PhotoDNA through this process. We may retain the submitted hash and the resulting check status in our internal image-upload audit records in accordance with our retention policy.

Sightengine

Where Sightengine moderation is enabled, the original uploaded image may be sent securely to Sightengine for automated analysis. The configured checks may include detection of potentially inappropriate, unsafe, or prohibited content.

Sightengine may process submitted images using infrastructure located in different countries or regions. The exact processing location may vary depending on Sightengine’s infrastructure, account configuration, and service availability. Any applicable international transfers are subject to the safeguards and contractual terms agreed with Sightengine.

8. Where your information is stored

Competition data is primarily stored using infrastructure located in the United Kingdom.

The application server, database and image storage used by Kerve are hosted with DigitalOcean in a London data centre.

The competition website is hosted using Vercel. Vercel operates infrastructure internationally and may process information in countries outside the UK. Where personal information is transferred internationally, appropriate safeguards will be used in accordance with applicable data protection law.

Some third-party services used to provide image safety and moderation services may also process information outside the UK.

Where required, Intercontinental Brands and its service providers will use appropriate legal safeguards for international transfers of personal information.

9. How long will your information be kept?

Kerve will securely store your competition entry data for the duration of the competition.

Following the competition closing date, the competition entry data will be transferred to Intercontinental Brands. Once the transfer has been successfully completed, Kerve will delete its copy of the competition entry data from its active systems.

Intercontinental Brands will retain competition entry data for a maximum of 30 days following the competition closing date, after which it will be securely deleted unless there is a legal or other legitimate reason requiring longer retention.

If you have separately opted in to ongoing marketing communications, Intercontinental Brands may retain your name and email address within its marketing systems for marketing purposes beyond this period. You can withdraw your marketing consent or unsubscribe from marketing communications at any time.

Kerve and its service providers may retain limited technical information, system logs or backup data for a limited period where this is necessary for security, system operation, legal compliance or disaster recovery purposes.

10. Marketing communications

If you choose to opt in to marketing communications, Intercontinental Brands may add your name and email address to its marketing database/CRM and use this information to send you ongoing marketing communications.

You will only be included in these marketing communications if you actively choose to opt in.

You can withdraw your consent or unsubscribe at any time. Each marketing communication will provide an appropriate way to unsubscribe.

Withdrawing your marketing consent will not affect your competition entry or your eligibility to participate in the competition.

11. Your data protection rights

Depending on the circumstances and applicable law, you may have rights in relation to your personal information, including the right to:

• Request access to the personal information we hold about you
• Ask us to correct inaccurate or incomplete information
• Request deletion of your personal information in certain circumstances
• Ask us to restrict how we use your personal information in certain circumstances
• Object to certain types of processing
• Request the transfer of your personal information to another organisation where applicable
• Withdraw your consent where we are relying on consent to process your information

To exercise your rights or ask a question about how your personal information is being used, please contact:

Intercontinental Brands (ICB) Ltd
Privacy contact: dataprotection@fortitudespirits.com

If your request relates specifically to processing carried out by Kerve on behalf of Intercontinental Brands, Kerve will assist Intercontinental Brands in responding to your request as required under the applicable data protection arrangements.

12. Automated processing

Certain uploaded images may be subject to automated image safety and moderation checks using third-party technologies.

These checks are used to help identify potentially prohibited or inappropriate content and to protect the integrity and safety of the competition.

Automated image checks do not determine who wins the competition.

Winner selection is carried out in accordance with the Competition Terms & Conditions.

13. Security

We take the security of your personal information seriously.

Appropriate technical and organisational measures are used to protect personal information against unauthorised access, accidental loss, misuse, alteration or disclosure.

Access to competition data is restricted to authorised personnel and service providers who require access for the purposes described in this Privacy Notice.

Competition data is stored using secure cloud infrastructure, with the application, database and image storage hosted separately from the public-facing website.

14. Complaints

If you have concerns about how your personal information has been handled, please contact us first using the details above so that we have an opportunity to address your concerns.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection regulator.

Further information about your data protection rights and how to make a complaint is available from the ICO.

15. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes to the competition, the way we process personal information, the services we use, or applicable legal and regulatory requirements.

The latest version will be made available on the competition website and will include the date on which it was last updated.

Data Controller: Intercontinental Brands (ICB) Ltd

Data Processor: Kerve Creative Limited

Competition: COSTA RICA SEA TURTLE CONSERVATION ADVENTURE

Prize: There is one prize for one winner and one guest: a Costa Rica sea turtle conservation adventure for two, with a total maximum value of £8,000.

Competition dates: The competition opens at 00:01 on 1 October 2026 and closes at 23:59 on 31 January 2027

Privacy contact: dataprotection@fortitudespirits.com