Your data
Privacy policy
What we collect, why we collect it, and what you can make us do about it.
Not yet reviewed by a solicitor
This wording is a working draft written to reflect how the competition actually operates. It is not legal advice and it has not been checked by a solicitor. Have it reviewed by someone qualified in UK competition, consumer and data protection law before taking real money.
Who is the controller
AutoBarn Comps is the data controller for personal data collected through this site. Company details and an ICO registration number must be added here before launch, and registering with the ICO is a legal requirement for a business processing personal data in this way.
What we collect
- To process your entry: name, email address, postal address, phone number, date of birth.
- To take payment: Stripe handles your card details. We receive only a payment reference and the outcome. We never see the card number.
- To run the draw: the ticket numbers allocated to you and which competition they belong to.
- Automatically: basic technical data such as IP address and browser type, from server logs.
Why, and on what legal basis
- Performance of a contract: processing your entry, allocating tickets, running the draw, contacting a winner and delivering a prize.
- Legal obligation: age verification, accounting records, and responding to lawful requests.
- Legitimate interests: preventing fraud and abuse, and keeping the site secure and working. We have considered your rights in reaching that view and you can object.
- Consent: marketing emails, and any non-essential cookies. You can withdraw consent at any time and it is one click in every email.
Who we share it with
- Stripe, for payment processing.
- Supabase, which hosts our database.
- Vercel, which hosts and serves this website.
- Delivery partners, where a prize needs transporting to you.
- Authorities, where we are legally required to disclose.
We do not sell your data, and we do not share it with third parties for their own marketing.
Publishing winners
Where you win, we will ask to publish your first name, county and winning ticket number so other entrants can see the prize was genuinely awarded. You can refuse and still take the prize. We will only publish a photograph or video of you if you agree to it separately.
How long we keep it
- Order and entry records: seven years, for accounting and tax purposes.
- Marketing consent records: until you withdraw consent, then a suppression record so we do not email you again.
- Server logs: 90 days.
Your rights
Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or hand it to another provider. You can object to processing based on legitimate interests, and withdraw consent at any time. We respond within one month.
To exercise any of these, contact us through the contact page. If you are not satisfied with our response, you can complain to the Information Commissioner's Office.
Where your data is held
Our database and hosting are configured to keep data within the UK or the European Economic Area wherever possible. Where a provider transfers data outside the UK, it is done under the safeguards UK GDPR requires, such as an adequacy decision or the International Data Transfer Addendum.