1. About us and this policy
EC4 Group Ltd (“we”, “us”, “our”) trades as The Competition Agency. We are a promotional marketing agency specialising in prize promotions, competitions, prize draws and instant-win mechanics, which we design and run on behalf of our clients.
This policy explains how we collect, use, share and protect personal data, and sets out your rights under the UK GDPR and the Data Protection Act 2018.
2. Who this policy applies to
This policy covers personal data we handle about:
Entrants — people who enter a promotion, competition or prize draw we operate
Winners and prize recipients — including guests travelling with a winner
Website visitors — people who use competitionagency.com
Client and prospect contacts — individuals at brands, agencies and media owners we work with
Suppliers and partners — including prize fulfilment providers and judges
3. Our role: controller or processor
Our role depends on the activity.
We act as a data controller for our own website, our marketing and business development, our supplier and client relationships, recruitment, and for promotions we run in our own name.
We usually act as a data processor when we run a promotion on behalf of a client brand. In those cases the client is the promoter and the controller, and they decide why and how entrant data is used. We process that data under a written contract that meets the requirements of Article 28 of the UK GDPR, and only on the client’s documented instructions.
We may act as a joint controller with a client where we jointly determine the purposes and means of processing. Where this applies, the promotion’s terms and conditions will say so and will identify the promoter.
Every promotion we run carries terms and conditions naming the promoter. If you entered a promotion and want to know who controls your data, check those terms or contact us and we will tell you.
4. The personal data we collect
4.1 Entrants
Identity and contact data: name, email address, postal address, telephone number
Age or date of birth, and confirmation that you meet the eligibility criteria
Country or region of residence
Entry data: your answer, tie-breaker, photo, video, recipe, artwork or other user-generated content; the date and time of entry; entry reference or unique code
Proof of purchase: receipt images, barcodes, batch codes, till numbers, retailer and store details
Social media handle and public profile information where a promotion runs on or through a social platform
Marketing preferences and consent records
Technical data: IP address, device and browser information, and cookie identifiers (see section 12)
4.2 Winners and prize recipients
In addition to the above:
Identity verification documents, such as a photograph of photo ID or proof of address, where we need to confirm a winner’s identity
Bank account or payment details, where a prize is cash or a cash-equivalent transfer
Passport details, date of birth and nationality for travel prizes
Travel insurance and next-of-kin details for travel prizes
Details of a guest or plus-one travelling with you
Photographs, video, voice recordings and quotes for publicity, where you have agreed to take part
Winner’s surname and county for publication or disclosure (see section 5)
National Insurance number or tax information, where a prize creates a tax reporting obligation
4.3 Special category data
Some prizes require us to collect data that receives extra protection under data protection law, for example:
Dietary requirements, allergies, accessibility needs or medical information relevant to a travel, event or experience prize
Health information required by a travel provider or insurer
We collect this only where it is necessary to deliver the prize safely, we ask for your explicit consent, and we share it only with the providers who need it.
4.4 Client, prospect and supplier contacts
Name, job title, employer, business email address and telephone number, correspondence, meeting notes, and information about your interests and requirements that helps us provide our services.
5. Where we get personal data from
Directly from you, when you enter a promotion, claim a prize, contact us or use our website
From our clients, where they run the entry mechanic themselves and pass entries to us
From social media platforms, where a promotion runs via a platform’s tools and you have entered through them
From media owners, retailers and partners involved in a promotion
From our verification, fraud-screening and prize fulfilment partners
From publicly available sources such as company websites and LinkedIn, for business-to-business contacts
6. How and why we use personal data
The table below sets out our purposes and the lawful basis we rely on. Where we act as a processor, the lawful basis is the promoter’s to determine, and this table describes the typical position.
| Purpose | Lawful basis |
|---|---|
| Registering and validating your entry; running the draw or judging; contacting you about the promotion | Performance of a contract — the promotion’s terms and conditions form a contract between you and the promoter |
| Verifying that you are eligible, including age and residency checks | Legal obligation, and our legitimate interests in running promotions lawfully and fairly |
| Selecting winners and notifying them | Performance of a contract |
| Awarding and delivering prizes, including arranging travel, events and experiences | Performance of a contract |
| Collecting dietary, accessibility or health information for a prize | Explicit consent |
| Publishing or making available the surname and county of major prize winners | Legal obligation and legitimate interests — the CAP Code requires promoters to publish or make available on request the surname and county of major prize winners, and to provide details to the Advertising Standards Authority on request |
| Using winner photographs, quotes or footage in marketing | Consent, given separately at the time |
| Detecting and preventing fraudulent, automated, duplicate or abusive entries | Legitimate interests in protecting the integrity of the promotion and the interests of genuine entrants |
| Sending you marketing about our own services or a promoter’s products | Consent, or the soft opt-in where permitted under the Privacy and Electronic Communications Regulations 2003 |
| Handling enquiries, complaints and disputes, including ASA or ICO investigations | Legitimate interests, and legal obligation |
| Meeting tax, accounting and regulatory record-keeping requirements | Legal obligation |
| Operating, securing and improving our website | Legitimate interests, and consent for non-essential cookies |
| Managing client, supplier and prospect relationships and business development | Legitimate interests in running and growing our business |
Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that our interests are not overridden by your rights. You can ask us for a summary of any of these assessments.
Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect processing carried out before you withdrew it, and it may mean we cannot progress your entry or deliver a prize.
7. Publication of winners
Advertising rules require promoters to make winner information available so that entrants and the ASA can verify a promotion ran fairly. Unless the promotion’s terms say otherwise, we will make available the surname and county of major prize winners.
If you object to your surname and county being published, tell us before the closing date and we will reduce the information published where the rules allow. We must still provide your details to the ASA on request.
Anything beyond surname and county — full name, town, photograph, video or quote — is used only with your separate consent.
8. Automated decision-making
Prize draws are decided by random selection, which may be carried out by verified randomising software supervised by an independent person. Judged competitions are decided by a human judging panel against published criteria.
We use automated checks to screen for duplicate, bot-generated and fraudulent entries. Where an automated check would disqualify you, a member of our team reviews the decision before it is applied. You can ask us to explain the outcome, contest it and ask for a human review by contacting us.
9. Who we share personal data with
The promoter — the client brand whose promotion you entered, where the terms say your data will be shared with them. Their own privacy policy will govern what they do with it.
Prize fulfilment and delivery partners — couriers, travel agents, event organisers, voucher and gift card issuers, experience providers
Verification and independent adjudication partners — including independent observers of a draw
Judges and judging panels, where a promotion is judged
Technology suppliers — hosting, entry platform, CRM, email delivery, analytics and security providers, acting as our processors under contract
Professional advisers — lawyers, auditors, insurers and accountants
Regulators and authorities — including the ASA, the ICO, HMRC, the police and other bodies where we are legally required or permitted to disclose
A buyer or successor, if we sell or reorganise our business
We do not sell personal data. We do not share entrant data with third parties for their own marketing unless you have consented and the promotion’s terms make that clear.
10. International transfers
Some of our suppliers operate outside the UK, and travel prizes may require us to send data to providers overseas. Where we transfer personal data outside the UK, we rely on one of the following:
UK adequacy regulations covering the destination country
The UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses
Another safeguard permitted by data protection law, including the specific exemptions that apply where a transfer is necessary to perform a contract with you, such as booking travel
You can ask us for details of the safeguards that apply to a particular transfer.
11. Security
We hold ISO/ 27001 certification for our information security management system. Our controls include:
Role-based access control and the principle of least privilege
Encryption of personal data in transit and at rest
Segregation of client and promotion datasets
Vetting and regular data protection and security training for staff
Supplier due diligence and contractual data protection terms
Vulnerability management, logging, monitoring and regular penetration testing
A documented incident response procedure, under which we assess personal data breaches and report qualifying breaches to the ICO within 72 hours and to affected individuals where required
No system is completely secure, but we take these obligations seriously and review our controls regularly.
12. Cookies and similar technologies
Our website uses cookies and similar technologies. Non-essential cookies, including analytics and advertising cookies, are set only with your consent, which you give through our cookie banner and can change at any time.
13. How long we keep personal data
Where we act as a processor for a client, we retain data for the period the client instructs, and then delete or return it. Where we act as a controller, our standard periods are:
| Data | Retention period |
|---|---|
| Unsuccessful entrant data | [6 months] after the promotion closes, unless a shorter period is agreed with the promoter |
| Winner records, including prize fulfilment records | 6 years from the end of the promotion, to defend claims and evidence compliance |
| Identity and payment verification documents | Deleted once verification is complete and the prize is fulfilled, and in any event within [3 months] |
| Marketing consents and preferences, including suppression lists | Until you withdraw consent; suppression records kept indefinitely so we can honour your opt-out |
| Winner publicity content used in marketing | [PERIOD OR “as agreed in the consent you gave”] |
| Financial and tax records | 6 years plus the current financial year |
| Client, supplier and prospect records | Duration of the relationship plus 6 years |
| Complaints and correspondence | [3 years] from resolution, or 6 years where linked to a claim |
| Website and security logs | [12 months] |
At the end of these periods we securely delete or anonymise the data.
14. Your rights
Under the UK GDPR you have the right to:
Be informed about how we use your data — this policy
Access a copy of the personal data we hold about you
Rectify inaccurate or incomplete data
Erase your data in certain circumstances
Restrict processing in certain circumstances
Portability — receive data you gave us in a structured, machine-readable format, where processing is based on consent or contract and is automated
Object to processing based on legitimate interests, and to object at any time to direct marketing
Withdraw consent at any time where we rely on consent
Not be subject to solely automated decisions with legal or similarly significant effects (see section 8)
To exercise any of these rights, contact us at [email protected]. We will respond within one month, and will tell you if we need to extend that period. There is normally no charge. We may ask you to verify your identity before we act.
If your data is being processed by us on behalf of a promoter, we will pass your request to them and support them in responding.
You can unsubscribe from marketing emails at any time using the link in any message we send.
15. Complaints
If you are unhappy with how we have handled your personal data, please tell us first at [PRIVACY EMAIL] so we can put it right.
You also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 ico.org.uk/make-a-complaint
16. Children
Our promotions are normally open only to entrants aged 18 or over, and the terms of each promotion state the minimum age. Where a promotion is open to under-18s, we ask for verifiable parental or guardian consent before collecting data and before awarding a prize, and we do not send marketing to children. We do not knowingly collect data from children outside these arrangements. If you believe a child has given us personal data, contact us and we will delete it.
17. Changes to this policy
We review this policy at least annually and update it when our processing changes. The version number and date at the top show when it was last revised. Material changes will be notified to you where we are required to do so.
This policy relates to EC4 Group Ltd trading as The Competition Agency. Individual promotions have their own terms and conditions, which may include additional privacy information specific to that promotion and to the promoter.