PRIVACYPOLICY.

Effective date: 20 September 2026. Award notice version 2026-09-20-open. Notify Me collection addendum: 2026-09-20-notify-1.

1. Who is responsible

Cuke Media LLC is responsible for the personal information described in this policy.

Privacy contact: contact@cukecoin.xyz, monitored by the CUKE team. Write to us at that address for the company’s postal details or to exercise any of the rights below.

This policy covers cukecoin.xyz, its CUKE of the Week pages, related registration and award administration, the optional CUKE newsletter and correspondence with us. Social platforms have their own privacy policies. This notice does not describe a future merchandise checkout, token sale or app that has not been launched; we will provide the relevant information before collecting data for a new service.

2. Information we use and where it comes from

• Website visits: technical information handled by our hosting and security systems, such as IP address, request time, requested page, browser information and error/security events. These logs are handled by our hosting provider (GoDaddy) under its hosting and security settings; its retention period is separate from our application records.
• Award registration: the X and Telegram usernames you give us, registration date, a participant reference, eligibility declarations, the version of the rules and privacy notice presented, and any separate display permission. Providing usernames is necessary to associate your eligible activity with your entry. We do not require your social-media passwords. A private entry link and a secure browser cookie let you submit contributions for your registration. We store a hash of the entry token; keep your private link confidential. This link is not verification of ownership of your social accounts.
• Participation review: relevant public X posts, creative submissions, links, dates and CUKE community Telegram contributions associated with registered participants, plus limited review notes and eligibility/award decisions. Information comes from your submission, the relevant social platform or our review of the CUKE group. We do not import private conversations or unrelated profile activity for this purpose.
• Award delivery: only the selected winner's information reasonably needed to verify eligibility, arrange payment and meet applicable recordkeeping duties. We ask the winner only for what is needed to pay the prize: a Solana wallet address for a USDC transfer, or a PayPal address if the winner prefers that method. We never request seed phrases or wallet private keys.
• Newsletter: your email address, signup and consent records, unsubscribe status and delivery information. Notify Me stores your email, signup time, explicit consent text and version, and privacy notice version in our private GoDaddy database. Email ownership is not yet verified. No newsletter provider is connected and no marketing email or tracking is sent by this temporary collection service. We will identify the delivery provider and any tracking before activating delivery.
• Contact requests: details you choose to include when asking for help or exercising privacy rights.

Registration does not itself verify that you own the handles. We may request a proportionate verification, such as confirming a code from the relevant account. We do not routinely request identity documents from every participant. Please do not send unnecessary sensitive information.

3. Why we use information

Where the GDPR or UK GDPR applies, the purposes and legal bases are:

• Operate the award: register you, match eligible contributions, review entries, communicate with you and deliver a prize under the award rules. Basis: performance of the participation agreement and steps taken at your request.
• Protect the service and fair participation: detect duplicate or fraudulent entries, secure administration and investigate substantiated disputes. Basis: legitimate interests in operating a secure and fair service, subject to an assessment of necessity and your rights.
• Newsletter: collect subscriptions for CUKE launch updates, news and offers, including merchandise and digital products, only if you separately consent. Basis: consent, which you may withdraw using the unsubscribe link or by contacting us. Joining the award does not subscribe you to marketing.
• Optional public handle display: show your chosen public handle on the provisional leaderboard and winner announcement when you separately permit it. Basis: consent. Declining does not reduce eligibility; a non-identifying participant reference will be used instead. Withdrawal stops future display under our control, without affecting prior lawful use.
• Legal and accounting requirements: keep information required by applicable law. Basis: the relevant legal obligation. In practice this means the records of prize payments, which we keep for 7 years for accounting purposes. Limited records needed for a specific legal claim may be retained based on legitimate interests and an assessed retention period.

We do not sell award registration information or use it for advertising audiences. We do not rank you by wealth, token holdings or purchases. The team makes the final award decision; the service has no automated social scoring or decision that awards a prize without human review.

4. Who can see information

Authorized CUKE personnel access information needed for their roles. Service providers may process data to host the website/database, operate email, provide backups and security or deliver a prize. Professional advisers or competent authorities may receive limited information when necessary and legally justified.

Providers: GoDaddy for hosting; the operator of our support mailbox; Microsoft 365 for our mailboxes; and the Solana network or PayPal when a prize is paid. Newsletter providers do not need the award participant database for this design.

Only the participant reference or permitted public handle, award week and award status appear publicly. The paired X and Telegram handles, private review notes and payment details are not published. Third parties may see information you independently post on social platforms. Public pages or posts may be copied by others outside our control.

5. International processing

The website, the registration file and its backups are hosted by GoDaddy. Access to the data is restricted to authorized team members and may involve international processing. The company contact address does not by itself identify the server location.

For transfers subject to GDPR or UK GDPR restrictions, we rely on the data processing terms of our providers and the Standard Contractual Clauses they include (GoDaddy Data Processing Addendum, Microsoft Data Protection Addendum). We do not claim that every provider is covered by an adequacy arrangement. You may contact us for information about applicable safeguards and how to obtain a copy.

6. How long we keep it

How long we keep each kind of information:

• Active award registrations: up to 365 days after registration, followed by scheduled deletion unless a separately documented legal duty requires limited records outside the routine registration system. To continue beyond that period, a new registration or a separately introduced renewal process is required. Team administration audit records are retained for 90 days after the action, unless a documented hold applies.
• Withdrawn registrations or closed campaign records: delete or anonymize within 90 days after withdrawal or campaign closure, unless a specific dispute or legal duty requires limited records for longer.
• Routine contribution evidence and review notes: 90 days after the relevant weekly decision, unless needed for an active dispute. Do not archive entire group histories.
• Public winner records: up to 12 months, with optional handle display removable following withdrawal of display permission. Provisional entries are replaced or removed as the week progresses.
• The application keeps short-lived anti-abuse counters, removed by daily maintenance after they expire. Its team audit trail is retained for 90 days. It does not keep a separate raw-IP security log. Hosting logs managed by GoDaddy have separate provider-controlled retention.
• Temporary Notify Me archive: up to 365 days after signup, or earlier on withdrawal or deletion request. A keyed hash of a withdrawn address is retained to prevent accidental re-subscription. You can withdraw now by contacting contact@cukecoin.xyz; future marketing messages will include an unsubscribe link.
• Prize/accounting and specific legal-claim records: 7 years for prize and accounting records; records tied to a specific legal claim are kept until the claim is closed.
• Backups: rolling 30-day retention. Private application backups from before a deletion are removed during daily maintenance, so they cannot restore the deleted record. Provider-managed backups follow the hosting provider’s separate policy.

7. Cookies, storage and external links

The site uses only what is necessary for security and administration: a session cookie for form security and the team panel, which lasts until the browser is closed; a private entry cookie lasting up to 365 days to associate your submissions with your registration; and the anti-abuse counter described above. Team access expires after 30 minutes of inactivity or 8 hours overall. The CUKE application does not add advertising or audience-analytics cookies. GoDaddy also injects a hosting-performance monitoring script into public HTML pages; this provider feature is separate from the signup database.

We do not add advertising pixels or audience analytics. Hosting-performance monitoring is handled by GoDaddy under its hosting settings. If we add advertising or audience analytics, we will describe them here first and ask for the consent the law requires. A link to a social platform is different from embedding its tracking tools: following the link takes you to that platform.

8. Your choices and rights

Contact us to ask about access, correction, deletion, restriction, portability or objection where applicable. You may withdraw consent at any time without affecting earlier lawful processing. You may complain to the competent supervisory authority without contacting us first. Under the GDPR, we normally respond within one month; permitted extensions will be explained within that month.

We verify requests proportionately, for example through a registered social account, and do not ask for unnecessary documents. Deleting the information needed to administer an entry ends future participation, but withdrawing optional display or newsletter consent does not affect prize eligibility. Other applicable laws may provide additional rights.

9. Age, security and updates

The award is intended for people aged 18 or older who also meet the published eligibility rules. Contact us if you believe an ineligible minor has registered.

We use access restrictions and security measures appropriate to the implemented service. No system can guarantee absolute security. Registration data is stored outside the public web folder, the team panel requires a personal login, and only authorized team members can read it.

We will date changes to this notice and provide appropriate notice of material changes before introducing a new processing activity. Historic notice and rules versions associated with an entry are retained for the justified period described above.