/// Data protection
GDPR & your data rights
SK COMPS collects personal data from entrants, so we are a data controller under the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003. This page sets out how we meet those rules and exactly how to exercise your rights. Our privacy notice gives the fuller detail.
1. Who is responsible
- • Data controller: SK COMPS.
- • Postal address: SK COMPS, PO Box 2026, Stockport, SK1 1AA
- • Data protection contact: privacy@skcomps.co.uk
- • General enquiries: hello@skcomps.co.uk
- • We are below the threshold that requires a Data Protection Officer, so requests are handled directly by the person who runs the draws.
- • We are registered with the Information Commissioner's Office as a data controller and pay the annual data protection fee.
2. What we do with your data, and why
Every use of your data has a lawful basis. We collect the minimum needed and nothing more — no date of birth, no payment details, no special category data.
Running a free draw, checking eligibility, picking and contacting a winner
Data: Name, email, house number or name, SK postcode, entry date, entry reference
Lawful basis: Article 6(1)(b) — performance of the contract created when you enter
Emailing you about this and future SK COMPS draws
Data: Name, email, consent record (wording, date and time)
Lawful basis: Article 6(1)(a) consent, plus Regulation 22 PECR
Preventing duplicate or fraudulent entries and verifying winners
Data: Email (hashed for uniqueness), postcode, winner ID and proof of address
Lawful basis: Article 6(1)(f) — legitimate interests in a fair, verifiable draw
Keeping prize, tax and audit records
Data: Winner name, prize awarded, date, value
Lawful basis: Article 6(1)(c) — compliance with a legal obligation
3. Consent for our draw emails
Entry is free. By entering I agree that SK COMPS may email me about this draw, its result and future SK COMPS draws and offers. I can unsubscribe at any time, and I understand that unsubscribing does not remove me from a draw I have already entered.
- • Consent is a positive action: the box is never pre-ticked and it is separate from the 18+ and terms confirmations.
- • We store the exact wording you agreed to along with the date and time, so we can evidence consent if challenged.
- • Every email carries a one-click unsubscribe link and our postal address, as PECR requires.
- • You can also unsubscribe by emailing privacy@skcomps.co.uk. We action it within 5 working days.
- • We never sell, rent or share your details with third-party marketers.
4. How long we keep it
At the end of each period data is securely deleted or irreversibly anonymised.
5. Your rights in full
Right to be informed
This page and our privacy notice explain everything we do with your data.
Right of access
Ask for a copy of everything we hold about you. Free, answered within one month.
Right to rectification
Get anything inaccurate corrected — a misspelt name or a wrong postcode.
Right to erasure
Ask us to delete your data. If the draw has not been held yet, this also removes your entry.
Right to restrict processing
Ask us to pause using your data while a concern is looked into.
Right to object
Object to anything we do under legitimate interests, including fraud checks.
Right to withdraw consent
Unsubscribe at any time with one click in any email. Past entries stay valid; you just stop hearing from us.
Right to data portability
Receive your data in a common machine-readable format such as CSV or JSON.
Rights around automated decisions
The only automated step is a postcode format check. Winners are drawn at random, and no profiling is used.
6. Making a request
- • Email privacy@skcomps.co.uk with the words "data request" and tell us which right you want to use.
- • Include the email address and postcode you entered with so we can find your records.
- • We may ask you to confirm your identity. We will not ask for more information than we need to do that.
- • We respond within one calendar month, free of charge. If a request is unusually complex we may extend by up to two further months and will tell you why within the first month.
7. Security, processors and transfers
- • Entries are stored in a database that this website cannot read from: the entry form can only add records, never list or download them.
- • Data is encrypted in transit over HTTPS and encrypted at rest by our host.
- • Access is limited to the people who run the draws, protected by strong passwords and two-factor authentication.
- • Our hosting, database and email suppliers act as processors under written contracts meeting Article 28, and only ever act on our instructions.
- • Data is held in the UK or European Economic Area where possible. Any transfer outside it relies on the UK International Data Transfer Agreement, the UK Addendum to the Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework.
8. Cookies
- • We use only cookies strictly necessary to make the site work, so no consent banner is required under PECR.
- • We do not use advertising, analytics or tracking cookies, or tracking pixels.
- • We do not build profiles of visitors or share behavioural data with anyone.
9. Data breaches
- • We keep an internal record of any personal data breach, however minor.
- • Where a breach is likely to risk your rights and freedoms we report it to the ICO within 72 hours of becoming aware of it.
- • Where the risk is high we also tell affected entrants directly, without undue delay, explaining what happened and what to do.
10. Children
Entry is limited to people aged 18 or over and we do not knowingly collect data about children. If you believe a child has entered, email privacy@skcomps.co.uk and we will delete the record.
11. Complaints
- • Please tell us first at privacy@skcomps.co.uk so we have the chance to put things right.
- • You can complain to the Information Commissioner's Office at any time: ico.org.uk, 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
- • Complaining to the ICO does not affect your other legal rights.
The controller name, contact details and postal address above are placeholders until you confirm the real ones, and you will need an active ICO registration before launch. Requiring marketing permission as the price of a free entry is a common promotional model, but the ICO's position is that consent should be freely given — have this reviewed by a UK data protection adviser before you scale up. This page is information, not legal advice. Last updated September 2026.