Home › Privacy
Privacy notice
Last updated: 29 October 2026
This notice explains how personal data is handled on competitionbrands.co.uk (“the site”, “we”, “us”) under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
1. Who we are (data controller)
The data controller is RCommerce, the operator of competitionbrands.co.uk. For anything about your personal data, including exercising your rights, contact us at info@competitionbrands.co.uk. We have not appointed a Data Protection Officer because we are not required to.
2. What we collect and why
| When | Data | Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|---|---|
| Newsletter sign-up (the weekly Comp Brands brief) | Email address, where you signed up, date and time of sign-up and confirmation, the consent wording you agreed to, a one-way hash of your IP address, browser user-agent | Sending the newsletter you asked for; keeping proof of your consent (double opt-in); preventing abuse | Consent (Art. 6(1)(a)) and PECR reg. 22. Proof of consent and abuse prevention: legitimate interests (Art. 6(1)(f)) |
| Make an offer on a domain or business | Name, email, the domain, your offer amount, your message, IP hash, user-agent | Replying to your offer and negotiating a possible sale | Steps taken at your request before entering into a contract (Art. 6(1)(b)); legitimate interests in running the marketplace |
| List your comp business | Name, email, website or domain, type of listing, description, your confirmation that you own the asset and are 18+, IP hash, user-agent | Assessing and replying to your listing request | Steps at your request before a contract (Art. 6(1)(b)); legitimate interests |
| Advertising enquiry | Name, company, email, the option you chose, your message, IP hash, user-agent | Sending you advertising options and availability | Steps at your request before a contract (Art. 6(1)(b)); legitimate interests in responding to business enquiries |
| Ordering a paid placement (on the advertise page or in a “Your brand here” sponsor slot) | Company, website, email, short description, logo link, notes, the page and slot you ordered from, your 18+ and advertising-terms confirmation, order and payment status, Stripe customer/subscription/payment IDs (not your card number), clicks on your ad, IP hash, user-agent | Taking payment, publishing your ad automatically once paid (your company name, description, logo and website link are shown publicly in the sponsor slots), checking ads after publication and removing ones that break the terms, receipts and service emails, refunds, accounting records | Contract (Art. 6(1)(b)); legal obligation for accounting records (Art. 6(1)(c)); legitimate interests in preventing fraud (Art. 6(1)(f)) |
| Featured brand waitlist | Email, company, website (optional), the page you joined from, date and time, IP hash, user-agent | Telling you when a Featured brand slot frees up | Steps at your request before a contract (Art. 6(1)(b)); legitimate interests in preventing abuse (Art. 6(1)(f)) |
| Emails you send us | Whatever you include in your email | Replying, handling corrections and claims of listings | Legitimate interests (Art. 6(1)(f)) |
| Analytics and advertising cookies (only if you accept them) | Pages visited, referrer, approximate location, device and browser data, cookie IDs (see section 10) | Understanding how the site is used; measuring advertising | Consent (Art. 6(1)(a); PECR) |
| Visiting the site | IP address and request data processed by our hosting provider for delivery and security | Delivering the site, keeping it secure, stopping spam (form rate limits) | Legitimate interests (Art. 6(1)(f)) |
Our legitimate interests are running and securing this B2B directory and marketplace and replying to business enquiries; we have balanced them against your rights and you can object at any time (see section 8). Please don't send us special category data (for example health information) through the forms.
3. Company information shown on the site
Company records on the site (company name, number, status, incorporation date, registered-office town and SIC codes) come from the public Companies House register and GOV.UK, under the Open Government Licence. We show the registered-office town only and do not publish officers' names or home addresses. Where a company record relates to an identifiable person (for example a sole director), we process it on the basis of our legitimate interests in publishing an accurate directory of the UK prize-competition industry. You can object or ask for a correction at info@competitionbrands.co.uk.
4. Newsletter: double opt-in and unsubscribing
After you enter your email, we send a confirmation link. You are only added to the list once you click it. Unconfirmed sign-ups are deleted automatically after 30 days. Every newsletter contains an unsubscribe link, and you can also email us to unsubscribe. Withdrawing consent does not affect processing that happened before.
5. Who we share data with
We do not sell your personal data or share it for others' marketing. We use these service providers (processors) acting on our instructions:
- Cloudflare, Inc.: website hosting, security, the form back-end and the database that stores form submissions and newsletter subscribers (stored in Cloudflare's Western Europe location).
- Google (Google LLC and affiliates, including Google Ireland Limited): Google Tag Manager, and analytics/advertising tags only if you consent (see section 10).
- Stripe (Stripe Payments Europe, Limited, Ireland, and its affiliates including Stripe, Inc. in the USA): card payments for paid placements. Stripe also acts as an independent controller for some data, for example for fraud prevention and its legal obligations; see stripe.com/privacy.
- Our email hosting provider: the mailbox at competitionbrands.co.uk that sends confirmation emails and receives your messages.
We may also disclose data if required by law, to protect our rights, or to a buyer if the site itself is sold (you would be told).
6. International transfers
Cloudflare, Google and Stripe operate global networks, so your data may be processed outside the UK, including in the EU and the USA. Where data leaves the UK we rely on UK adequacy regulations (for the EEA, and for US organisations certified under the UK Extension to the EU-US Data Privacy Framework) or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
7. How long we keep it
- Newsletter subscribers: while you are subscribed. After you unsubscribe we keep only your email address and the unsubscribe date on a suppression list so we never email you again by mistake, unless you ask us to erase it.
- Unconfirmed newsletter sign-ups: deleted after 30 days.
- Offers, listing requests and advertising enquiries (including earlier sponsor slot requests): up to 24 months after our last contact, or longer if they lead to a contract (then as long as needed for accounting and legal purposes, usually 6 years).
- Paid placement orders and payment records: for as long as tax and accounting law requires (usually 5–6 years after the end of the tax year); unpaid orders: up to 12 months.
- Featured brand waitlist: until we have offered you a slot or you ask to be removed, and no longer than 12 months.
- Rate-limit records (IP hashes): 24 hours.
8. Your rights
Under UK GDPR you have the right to: access your data; have it corrected; have it erased; restrict its use; data portability; object to processing based on legitimate interests; and withdraw consent at any time. You also have the right not to be subject to solely automated decisions with legal effects; we do not make any. To use any right, email info@competitionbrands.co.uk. We reply within one month and won't charge a fee in most cases. We may need to confirm your identity.
9. Complaints
Please contact us first at info@competitionbrands.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, phone 0303 123 1113.
10. Cookies and similar technologies
Google Tag Manager. We use Google Tag Manager (container GTM-5RJ69MH4), a service of Google, to load tags on the site. Tag Manager itself does not set cookies to profile you. Any analytics tags (for example Google Analytics, to see which pages are useful) or advertising tags (ad measurement and personalisation) are loaded through Tag Manager only with your consent.
Your choices. When you first visit, a cookie banner lets you choose. “Essential only” turns analytics and advertising off, “Accept all” turns both on, and “Customise” lets you choose each one separately. Until you choose, Google Consent Mode keeps both switched off (denied by default), so no analytics or advertising cookies are set. While consent is denied, Google tags may still send limited cookieless signals (for example, that a page was viewed) without setting cookies or identifying you.
What's collected with consent. With analytics consent, Google Analytics may record pages visited, the referring site, approximate location (country/city), device, browser and screen type, and a random cookie ID. With advertising consent, Google may also use cookies to measure and personalise ads. We don't send names or email addresses to Google.
Lawful basis. Consent (UK GDPR Art. 6(1)(a) and PECR regulation 6) for analytics and advertising cookies. Strictly necessary storage, such as remembering your cookie choice in your browser's local storage and security cookies our hosting provider may set to filter malicious traffic, does not need consent.
Provider and transfers. Google LLC (USA) and its affiliates, including Google Ireland Limited, provide these services. See Google's privacy policy and how Google uses data from partner sites. Data may be transferred to and processed in the USA and other countries; see section 6.
Change or withdraw consent. Use the “Cookie settings” link in the footer of every page () to change either choice at any time. Withdrawing consent is as easy as giving it and does not affect processing before you withdrew. You can also delete cookies and site data in your browser settings.
11. Security
All traffic is encrypted (HTTPS). Form data is stored in a private database accessible only to us. We store a one-way hash of IP addresses, not the address itself.
12. Age
The site and newsletter are for adults (18+) working in or around the prize-competition industry. We do not knowingly collect data from children.
13. Changes
We will update this page if our practices change and show the new date at the top. Significant changes affecting subscribers will be emailed to them.