PRIVACY POLICY

---

Privacy Policy

MadComps UK respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website, enter competitions, contact us, make a purchase, sign up for updates, or otherwise interact with us.

Please read this Privacy Policy carefully together with our Terms and Conditions, Competition Rules, Cookie Policy, and Refund / Cancellation Policy.

1. Who we are

1.1. For the purposes of data protection law, the data controller is:

MadComps UK
Mad&Dad Uk
14 Museum Place, Cardiff, CF10 3BH
Email: info@madcomps.com

1.2. MadComps UK is responsible for deciding how and why your personal data is used. Under the UK GDPR, the organisation that decides these purposes and means is the “controller.” 

2. What this policy covers

2.1. This Privacy Policy applies to personal data collected through:
a. our website;
b. competition entry forms and checkout;
c. contact forms and customer support communications;
d. winner contact and prize fulfilment;
e. newsletter or marketing sign-up forms; and
f. cookies and similar technologies used on the website.

3. The personal data we collect

3.1. We may collect, use, store, and transfer the following categories of personal data:

a. Identity data: name, title, username, date of birth, or other identity information you provide.
b. Contact data: billing address, delivery address, email address, telephone number.
c. Account and entry data: competition entries, question responses, ticket quantities, order confirmations, and customer account information.
d. Transaction data: payment-related information, purchase history, refunds, chargebacks, and entry records.
e. Technical data: IP address, browser type, device information, operating system, and website usage data.
f. Profile and preference data: saved preferences, marketing preferences, and competition interests.
g. Communication data: messages sent through contact forms, customer service emails, and support correspondence.
h. Prize fulfilment data: shipping information, tracking information, and winner contact records.

3.2. We do not intend to collect more personal data than is reasonably necessary for the purposes set out in this policy. UK GDPR requires personal data to be adequate, relevant, and limited to what is necessary. 

4. How we collect your personal data

4.1. We collect personal data:
a. directly from you when you enter competitions, complete forms, make purchases, contact us, or subscribe to updates;
b. automatically through cookies and similar technologies when you use our website; and
c. from service providers involved in payment processing, website hosting, analytics, fraud prevention, and delivery services.

5. How we use your personal data

5.1. We may use your personal data for the following purposes:
a. to operate and administer the website;
b. to process competition entries and purchases;
c. to verify entries and enforce ticket limits and competition rules;
d. to contact winners and arrange delivery of prizes;
e. to respond to enquiries and provide customer support;
f. to process payments, refunds, duplicate charge issues, and chargeback disputes;
g. to maintain security, prevent fraud, and protect the fairness and integrity of competitions;
h. to send service-related communications about your entries, purchases, or account;
i. to improve the website, customer experience, and competition offering;
j. to keep records needed for legal, regulatory, tax, accounting, and dispute-handling purposes; and
k. where permitted, to send marketing communications about competitions, offers, updates, and related services.

6. Our lawful bases for processing

6.1. Under the UK GDPR, we must have a lawful basis for using your personal data. Depending on the activity, we may rely on one or more of the following:

a. Contract: where processing is necessary to take steps at your request or to perform a contract with you, such as processing an entry, payment, prize delivery, or customer support linked to your order.
b. Legal obligation: where we need to comply with legal or regulatory duties, including accounting, tax, consumer, fraud-prevention, or record-keeping obligations.
c. Legitimate interests: where it is reasonably necessary for our legitimate business interests and those interests are not overridden by your rights and interests, for example website administration, fraud prevention, competition integrity, internal record keeping, and service improvement. The ICO recognises legitimate interests as one of the lawful bases under the UK GDPR.
d. Consent: where consent is required, for example for certain cookies or some direct marketing activity. PECR and UK GDPR both need to be considered for cookies and electronic marketing. 

6.2. Where we rely on consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn. This reflects standard UK GDPR practice on consent-based processing. 

7. Marketing communications

7.1. We may send you service messages relating to your account, entries, orders, payments, prize fulfilment, or important website changes. These are not the same as optional promotional marketing.

7.2. Where we send promotional emails or texts to individuals, we will do so in accordance with applicable UK law, including PECR and the UK GDPR. PECR restricts unsolicited direct marketing by email, text, phone, and similar electronic means, and specific consent is often required. 

7.3. If you sign up to receive marketing, or if we otherwise lawfully send marketing to you, you can opt out at any time by:
a. using the unsubscribe link in an email;
b. following any stop instruction in a text message; or
c. contacting us using the details in this policy.

7.4. We may keep a suppression record of your opt-out request so that we do not send you further marketing in error. That is generally consistent with data minimisation and compliance practice. 

8. Cookies and similar technologies

8.1. Our website may use cookies and similar technologies for essential site functions, performance, analytics, security, and user preferences.

8.2. PECR applies to cookies and similar technologies, not only where personal data is processed. Consent is generally required for non-essential cookies, subject to the applicable legal framework and any current exemptions. 

8.3. You can manage your cookie preferences through our cookie banner or browser settings, where available.

8.4. Further information should be set out in our Cookie Policy.

9. Sharing your personal data

9.1. We may share your personal data where reasonably necessary with:
a. payment service providers;
b. website hosts, developers, and technical support providers;
c. email or customer communications providers;
d. analytics and security providers;
e. delivery, courier, and fulfilment providers;
f. professional advisers such as legal, accounting, or compliance advisers;
g. regulators, law enforcement, or government bodies where required or permitted by law; and
h. any purchaser, investor, or business transferee where the business or assets are sold or reorganised, subject to appropriate confidentiality and legal protections.

9.2. We require service providers processing personal data on our behalf to act only on instructions and to apply appropriate security measures. Controller and processor obligations are part of the UK GDPR framework and the Data Protection Act 2018. 

10. International transfers

10.1. Some of our service providers may store or process personal data outside the UK.

10.2. Where personal data is transferred internationally, we will take steps to ensure that appropriate safeguards are in place in accordance with UK data protection law. The UK GDPR regulates international transfers and the ICO notes that the law has been clarified rather than fundamentally rewritten by later reforms. 

11. Data retention

11.1. We will not keep personal data for longer than is necessary for the purposes for which it was collected, including for legal, regulatory, tax, accounting, fraud-prevention, dispute, and customer service purposes.

11.2. Retention periods may vary depending on the type of data and the purpose of processing. For example:
a. competition entry and transaction records may be kept for a reasonable period for audit, fraud prevention, and dispute handling;
b. tax and accounting records may be kept for the period required by law or good practice;
c. customer support records may be kept for a reasonable period to manage complaints or queries;
d. marketing records may be kept until you opt out or until they are no longer needed; and
e. cookie data may be retained in line with our Cookie Policy and the settings used.

11.3. Storage limitation is one of the UK GDPR principles, and organisations should not keep personal data on the off chance it may be useful in future. 

12. Data security

12.1. We take appropriate technical and organisational measures to help protect personal data against unauthorised access, loss, misuse, alteration, or disclosure.

12.2. However, no online system can be guaranteed to be completely secure. You should also take care to protect your own account and device information.

13. Your data protection rights

13.1. Depending on the circumstances, you may have the following rights under the UK GDPR:
a. the right to be informed;
b. the right of access;
c. the right to rectification;
d. the right to erasure;
e. the right to restrict processing;
f. the right to data portability;
g. the right to object; and
h. rights relating to automated decision-making, where applicable. The ICO lists these individual rights as part of UK GDPR guidance. 

13.2. These rights are not absolute and may be subject to legal exceptions.

13.3. To exercise any of your rights, please contact us using the details below.

14. Complaints

14.1. If you have concerns about how we use your personal data, please contact us first so we can try to resolve the issue.

14.2. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection matters. The ICO is the recognised UK regulator for these purposes. 

15. Children’s data

15.1. Our website and competitions should only be used in accordance with our Terms and Conditions and competition eligibility rules.

15.2. If we become aware that personal data has been submitted in a way that should not have happened under our website rules, we may delete or restrict that data where appropriate.

15.3. Because your brand story refers to teaching your child about business, be careful not to state that the site is “for children” unless it truly is designed and operated that way. A prize competition site that takes payments and uses marketing should be cautious here. That is a drafting judgment rather than a quoted legal rule.

16. Third-party links

16.1. Our website may contain links to third-party websites, services, or social media platforms.

16.2. If you click a third-party link, that third party’s own privacy information and terms will apply. We are not responsible for third-party privacy practices.

17. Changes to this Privacy Policy

17.1. We may update this Privacy Policy from time to time.

17.2. The latest version published on the website will apply from the date shown on the page.

17.3. We recommend that you review this page periodically to stay informed about how we use personal data.

18. Contact us

18.1. If you have any questions about this Privacy Policy or wish to exercise your rights, please contact:

MadComps UK
Mad&Dad Uk
14 Museum Place, Cardiff, CF10 3BH
Email: info@madcomps.com