WinnerSelect Privacy Policy
Last updated: September 2026
WinnerSelect is operated by UKCPSA Limited, a company registered in England and Wales under company number 16797263, whose registered office is at 3rd Floor, 86–90 Paul Street, London, United Kingdom, EC2A 4NE.
This Privacy Policy explains how we collect, use, store and protect personal information when you use the WinnerSelect website, create a WinnerSelect account, subscribe to our services, contact us or use our winner selection tools.
For questions about this Privacy Policy or how we use personal information, contact:
hello@winnerselect.co.uk
1. Who we are
For personal information relating to WinnerSelect customers, account holders, website visitors and people who contact us, UKCPSA Limited is the data controller.
When a WinnerSelect customer uploads information about entrants into the winner selection tool, the customer will generally be the data controller and UKCPSA Limited will act as a data processor on that customer's behalf.
The data-processing terms governing that relationship are included in the WinnerSelect Terms of Service.
2. Information we collect about WinnerSelect customers
When you create or use a WinnerSelect account, we may collect information including:
- your name;
- business or organisation name;
- email address;
- account login information;
- subscription and plan information;
- billing and payment status;
- communications with us;
- support requests;
- information about how you use WinnerSelect;
- IP address;
- browser and device information;
- login and security information; and
- technical logs necessary to operate, secure and troubleshoot the Service.
We only collect information that is reasonably necessary to provide, secure, administer and improve WinnerSelect.
3. Payment information
Payments for WinnerSelect may be processed by third-party payment providers such as Stripe.
WinnerSelect does not normally receive or store your full debit or credit card number.
Our payment provider may process information such as:
- your name;
- billing address;
- payment card information;
- transaction information; and
- fraud-prevention information.
The payment provider processes this information in accordance with its own privacy policy and applicable data-protection law.
WinnerSelect may receive limited information from the payment provider, such as confirmation that a payment succeeded or failed, the subscription purchased, transaction identifiers and billing status.
4. Entrant data uploaded for winner selection
WinnerSelect is deliberately designed to minimise the amount of personal information required to conduct a draw.
Customers should normally upload only:
- entrant or participant names; and
- ticket, entry or other identifying numbers.
WinnerSelect does not require email addresses, postal addresses, telephone numbers, payment details or other contact information in order to select a winner.
Customers must not upload unnecessary personal information to WinnerSelect.
In particular, customers should not upload:
- email addresses;
- postal addresses;
- telephone numbers;
- payment or banking information;
- passwords;
- identity documents;
- dates of birth unless genuinely necessary;
- health information;
- biometric information;
- information revealing racial or ethnic origin, political opinions, religion or beliefs, trade union membership or sexual orientation; or
- other special-category or sensitive personal information.
The customer uploading the information is responsible for deciding what information is included in its draw file and for ensuring that it has a lawful basis for processing that information.
5. Our role when processing entrant information
Where a customer uploads entrant information for the purpose of conducting a draw, WinnerSelect generally processes that information on behalf of the customer.
In those circumstances:
- the customer is normally the controller;
- UKCPSA Limited is normally the processor;
- the customer determines why the information is being processed;
- WinnerSelect processes it to provide the winner selection service; and
- WinnerSelect does not use entrant information for its own marketing purposes.
Our obligations as processor are set out in the WinnerSelect Terms of Service.
6. Why we use personal information
We may use personal information to:
- create and manage WinnerSelect accounts;
- authenticate users;
- provide the WinnerSelect Service;
- process and manage subscriptions;
- provide customer support;
- respond to enquiries;
- send essential service communications;
- maintain draw records where required by the Service;
- maintain the security and integrity of WinnerSelect;
- detect and prevent misuse, fraud or security threats;
- troubleshoot technical problems;
- improve and develop WinnerSelect;
- maintain appropriate business and financial records;
- comply with legal and regulatory obligations; and
- establish, exercise or defend legal claims.
We do not sell personal information.
7. Our lawful bases for processing
Depending on the circumstances, we may process personal information because:
Contract
Processing is necessary to enter into or perform our contract with you, including providing your WinnerSelect account and subscription.
Legitimate interests
We may process information where necessary for our legitimate business interests, including:
- operating and improving WinnerSelect;
- maintaining service security;
- preventing fraud and misuse;
- communicating with business customers;
- keeping appropriate business records; and
- protecting our legal rights.
Where we rely on legitimate interests, we consider whether those interests are overridden by the rights and interests of the individual concerned.
Legal obligation
We may process information where necessary to comply with legal requirements, including accounting, taxation, regulatory and law-enforcement obligations.
Consent
Where required, we may rely on consent.
Where processing is based on consent, you may withdraw that consent at any time.
Withdrawal does not affect processing already carried out lawfully before consent was withdrawn.
8. Marketing communications
We may send customers relevant communications about WinnerSelect where permitted by law.
Essential account, security, billing and service messages are not marketing communications and may still be sent where necessary to operate your account.
Where required, marketing emails will include an appropriate method of opting out.
You can also ask us to stop sending marketing communications by contacting:
hello@winnerselect.co.uk
9. Cookies and similar technologies
WinnerSelect may use cookies and similar technologies where necessary to operate the website and Service.
These may be used for purposes including:
- keeping users signed in;
- security;
- remembering account preferences;
- maintaining session information;
- understanding technical performance; and
- measuring use of the website and Service.
Where cookies are not strictly necessary, we will obtain consent where required by law.
Where you consent, we use Google Analytics to understand how our website is used, and the Meta pixel to measure and target our advertising. Neither is loaded unless you accept them, and you can change or withdraw your choice at any time using the cookie choices control in the footer of any page. Our Cookie Policy describes both in detail.
Further information may be provided through our cookie notice or cookie-management tool.
10. Who we share personal information with
We may share personal information with trusted service providers where reasonably necessary to operate WinnerSelect.
These may include providers of:
- website and application hosting;
- cloud infrastructure;
- databases and storage;
- email delivery;
- payment processing;
- security and monitoring;
- analytics;
- advertising and advertising measurement;
- customer support;
- technical services; and
- professional services such as accountants, legal advisers and insurers.
We only provide service providers with information reasonably necessary for the services they perform.
Where a third party processes personal data on our behalf, we take reasonable steps to ensure appropriate contractual and data-protection safeguards are in place.
Not every recipient acts on our behalf. Where you have consented to advertising cookies, the Meta pixel sends information about your visit to this website to Meta Platforms, which uses it for its own purposes as well as ours, including improving its advertising systems. For that processing we and Meta are independent or joint controllers rather than controller and processor, and Meta's own privacy policy governs what it does with the information. Google acts as our processor for Google Analytics. Both may process information outside the United Kingdom, as described in section 12.
We may also disclose information where reasonably necessary:
- to comply with law or a court order;
- to respond to a lawful request from a regulator or public authority;
- to investigate fraud or criminal activity;
- to protect WinnerSelect, UKCPSA Limited or another person's rights or security; or
- in connection with a merger, restructuring, financing, acquisition or sale of all or part of the business.
We do not sell entrant or customer personal information to third parties.
11. Sub-processors
WinnerSelect may use third-party infrastructure and service providers to process information on our behalf.
Where those providers process entrant data uploaded by customers, they may act as sub-processors.
We require appropriate contractual safeguards to be put in place where required by applicable data-protection law.
Further information about material sub-processors may be made available to WinnerSelect customers on request.
12. International transfers
Some of our service providers may process or store personal information outside the United Kingdom.
Where personal information is transferred internationally, we will take appropriate steps required by applicable data-protection law to ensure that the information remains protected.
These steps may include relying on:
- countries recognised as providing an adequate level of protection;
- approved contractual safeguards;
- the UK International Data Transfer Agreement;
- the UK Addendum to approved standard contractual clauses; or
- another lawful transfer mechanism.
13. How long we keep personal information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and contractual requirements.
Different types of information may therefore have different retention periods.
WinnerSelect account information
Account and subscription information may be retained while the account remains active and for an appropriate period afterwards where required for legal, accounting, fraud-prevention or dispute-resolution purposes.
Financial records
Information required for accounting and taxation purposes may be retained for the period required by applicable law.
Support communications
Support and customer-service communications may be retained for a reasonable period to maintain service history, resolve disputes and improve support.
Technical and security logs
Technical logs may be retained for an appropriate period for security, troubleshooting, fraud prevention and system integrity.
Entrant and draw data
Entrant information uploaded for a draw is retained only for as long as reasonably necessary to provide the relevant WinnerSelect functionality and in accordance with our documented retention arrangements.
Entrant lists uploaded for a draw are deleted 90 days after the draw.
The winning entry (the ticket number and name, or the phone number) is kept permanently as part of the draw record, because it is the evidence that the draw was carried out fairly and may be needed to answer disputes or questions from regulators. Apart from the winning entry, WinnerSelect does not keep entrant information indefinitely.
Where entrant information is deleted from active systems, copies may remain temporarily in secure backups until those backups are overwritten or deleted through the normal backup cycle.
14. Security
We take reasonable technical and organisational measures designed to protect personal information against:
- unauthorised access;
- unlawful processing;
- accidental loss;
- alteration;
- disclosure; and
- destruction.
Measures may include access controls, authentication, encryption where appropriate, secure infrastructure, logging, monitoring, backups and restrictions on staff or contractor access.
No internet-based system can be guaranteed to be completely secure, but we take reasonable steps appropriate to the nature of the information we process.
15. Data breaches
We maintain procedures for identifying, investigating and responding to personal-data breaches.
Where a breach is likely to result in a risk to individuals and notification is required by law, we will notify the relevant supervisory authority.
Where required by law, we will also notify affected individuals.
Where a breach affects entrant information that WinnerSelect processes on behalf of a customer, we will notify the relevant customer without undue delay in accordance with our data-processing obligations.
16. Your data-protection rights
Depending on the circumstances, UK data-protection law may give you rights including:
- the right to be informed about how your personal information is used;
- the right to access personal information held about you;
- the right to correct inaccurate information;
- the right to request deletion of information in certain circumstances;
- the right to restrict processing in certain circumstances;
- the right to object to certain processing;
- the right to data portability in certain circumstances; and
- rights relating to certain forms of automated decision-making.
These rights are not absolute and may depend on the circumstances and lawful basis for processing.
To exercise a right relating to information for which UKCPSA Limited is the controller, contact:
hello@winnerselect.co.uk
We may need to verify your identity before responding.
17. Entrants wishing to exercise their rights
If you entered a competition operated by one of our customers and your information was uploaded to WinnerSelect, the competition operator will normally be the controller of that information.
You should therefore usually contact the competition operator directly if you wish to:
- access your information;
- correct your information;
- request deletion;
- object to processing; or
- exercise another data-protection right relating to your competition entry.
If you contact WinnerSelect about entrant information we process on behalf of a customer, we may refer the request to the relevant customer and assist that customer where required under applicable data-protection law.
18. Automated decision-making
WinnerSelect performs random winner selection based on the entry pool supplied by a customer.
The selection is performed for the purpose of identifying a potential winner in accordance with the customer's instructions.
WinnerSelect does not determine whether an entrant is legally or contractually entitled to receive a prize.
The competition operator remains responsible for checking eligibility and confirming the winner before making an award.
WinnerSelect does not use entrant information for profiling, behavioural advertising, credit scoring or similar automated evaluation.
19. Children
WinnerSelect is a business-to-business service and is not intended to be used directly by children.
Competition operators may operate competitions in which younger people participate where lawful.
Where an operator uploads entrant information relating to a child, the operator is responsible for ensuring that the collection and processing of that information is lawful and appropriate.
Customers should minimise the amount of children's personal information uploaded to WinnerSelect and should not upload unnecessary sensitive or identifying information.
20. Links to other websites
WinnerSelect may contain links to third-party websites or services.
We are not responsible for the privacy practices of websites or services operated by third parties.
You should review the privacy information provided by those organisations when using their services.
21. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect:
- changes to WinnerSelect;
- changes to how we process information;
- changes in our service providers;
- changes in law or regulatory guidance; or
- improvements to our privacy practices.
The current version will be published on the WinnerSelect website.
Where a material change significantly affects how we use existing personal information, we will take reasonable steps to bring the change to the attention of affected users where required.
22. Complaints
If you have concerns about how UKCPSA Limited has handled your personal information, please contact us first so that we can investigate:
hello@winnerselect.co.uk
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator.
Information about making a complaint is available at ico.org.uk.
23. Contact details
WinnerSelect is operated by:
UKCPSA Limited Trading as WinnerSelect
Company number: 16797263
Registered office: 3rd Floor, 86–90 Paul Street London United Kingdom EC2A 4NE
Email: hello@winnerselect.co.uk
Website: winnerselect.co.uk