Last updated: 7 May 2026
1. About this policy
This privacy policy explains how OctoComps Ltd (referred to in this policy as “OctoComps”, “we”, “us” or “our”) collects, uses and protects your personal data when you visit our website, create an account, enter our prize competitions (whether by paid entry or by free postal entry), receive marketing from us, or otherwise interact with us.
OctoComps is the data controller for your personal data. We are committed to handling it in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
Our website is not directed at children. We do not knowingly collect personal data from anyone under 18, and you must be 18 or over to enter our competitions.
Please read this policy alongside our Cookie Policy and our Terms and Conditions, which together describe how OctoComps operates.
2. Who we are and how to contact us
If you have any question about this policy, your personal data, or how to exercise your rights, please contact our data privacy lead:
| Legal entity | OctoComps Ltd |
|---|---|
| Company number | 17207393 |
| Address | OctoComps Ltd, PO Box 81810, London, E17 0DL |
| ICO registration number | Pending registration — to be inserted on publication |
| Contact email | contact@octocomps.co.uk |
| Telephone | 0203 633 6350 |
You also have the right to complain to the UK Information Commissioner’s Office (ICO) at any time. We would, however, appreciate the opportunity to put things right first, so please contact us before you approach the ICO. You can reach the ICO at ico.org.uk or on 0303 123 1113.
3. The personal data we collect
We collect and process the following categories of personal data. Not all of it applies to every user — what we hold about you depends on how you use OctoComps.
| Category | What it includes |
|---|---|
| Identity Data | First name, last name, username, date of birth and a profile picture |
| Contact Data | Home/billing address, email address and telephone number. |
| Account Data | Login credentials (password stored in hashed form), account preferences, account activity, your wallet balance and any cashback or charity allocations recorded against your account. |
| Transaction Data | Records of competition entries (paid and free postal), tickets purchased, draws entered, prizes won, refunds and other purchase history. |
| Payment Data | Payment status, transaction reference numbers and the last four digits/card type used. Full payment card details are processed by our payment provider and are never stored on OctoComps systems. |
| Verification Data | Information used to confirm your age, identity and eligibility to enter and to receive a prize. |
| Support Data | The contents of any messages, emails, web-form submissions or recorded calls between you and our customer service team. |
| Marketing & Communications Data | Your marketing preferences, the consents you have given us, and your engagement with our marketing (e.g. opens, clicks, opt-outs). |
| Technical Data | IP address, device identifiers, browser type and version, time zone setting, operating system, login data and other technology used to access our website. |
| Usage Data | Information about how you use our website and services, including pages visited, features used and referrer information. |
| Prize Publicity Data | Where you are a winner: your username, town, photographs, video and quotes used to promote the competition results. |
Special category data. We do not seek to collect special category data (such as health, racial or ethnic origin, religion, sexual orientation, or biometric data) and we do not collect information about criminal convictions or offences in the ordinary course of running OctoComps.
If you do not provide certain data. Some data is required by law or under our terms with you (for example, your name, address, date of birth and proof of age). Without it we cannot register you, enter you into a draw, or release a prize to you.
4. How we collect your personal data
We collect personal data in three ways:
- Directly from you — when you create an account, complete a paid or free postal entry, top up or use a wallet, contact our support team, sign up for marketing, take part in a survey, or respond to a verification request.
- Automatically — as you use our website, through cookies, server logs and similar technologies. Please see our Cookie Policy for full details.
- From third parties — including our payment provider, our age and identity verification provider, our analytics and advertising providers, and (where relevant) public sources such as Companies House, the Royal Mail postcode database or fraud-prevention databases.
5. How we use your personal data and our lawful basis
Under UK GDPR, we must have a lawful basis to process personal data. The table below sets out what we do with your data, why, and the lawful basis we rely on. We may rely on more than one basis for the same activity.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Create and manage your OctoComps account | Identity, Contact, Account, Technical | Performance of contract |
| Process your paid competition entries, take payment, refund where applicable, allocate tickets to draws, and confirm your entry | Identity, Contact, Transaction, Payment | Performance of contract; legal obligation (record-keeping) |
| Process free postal entries on equal terms with paid entries (no purchase necessary) | Identity, Contact, Transaction | Performance of contract; legitimate interests (running compliant prize competitions) |
| Verify that you are 18 or over and eligible to enter and to receive a prize | Identity, Verification | Legal obligation; legitimate interests (regulatory compliance, prevention of underage entry) |
| Carry out responsible-play and self-exclusion checks, including via GAMSTOP, and apply any self-exclusion to your account | Identity, Verification, Account | Legitimate interests (player protection, regulatory good practice); legal obligation where applicable |
| Operate the OctoComps wallet, including credits, cashback, charity contributions and withdrawals | Account, Transaction, Payment | Performance of contract |
| Conduct draws fairly, notify winners, deliver or transfer prizes, and provide proof of fair administration to the ASA where required | Identity, Contact, Transaction, Verification, Prize Publicity | Performance of contract; legal obligation; legitimate interests (evidence of proper administration) |
| Detect and prevent fraud, abuse, money-laundering, multiple-account abuse and bot activity | Identity, Contact, Transaction, Payment, Technical, Usage | Legitimate interests (protecting the integrity of our competitions and our other users); legal obligation |
| Respond to your support queries, complaints and feedback | Identity, Contact, Support | Performance of contract; legitimate interests (providing good service) |
| Send you service messages — entry confirmations, password resets, prize notifications and policy changes | Identity, Contact, Account, Transaction | Performance of contract; legal obligation |
| Send you marketing about our own competitions and offers, where you have opted in or where the soft opt-in applies | Identity, Contact, Marketing | Consent (SMS and most email); legitimate interests where the soft opt-in applies, subject to your right to opt out |
| Personalise your experience and serve relevant ads on our site and on third-party platforms | Identity, Technical, Usage, Marketing | Consent (for non-essential cookies and tracking); legitimate interests (running our business) |
| Use winners’ usernames, town/county, photographs, video and quotes to promote results | Identity, Prize Publicity | Legitimate interests (transparency, proof of fair conduct, marketing); separate consent for photographs and video |
| Meet our legal, accounting, tax and regulatory obligations | All categories as relevant | Legal obligation; legitimate interests |
| Establish, exercise or defend legal claims, and protect our rights and the rights of our users | All categories as relevant | Legitimate interests; legal obligation |
| Run, secure, develop and improve our website, products and services | Account, Technical, Usage | Legitimate interests (running and improving our business) |
6. Free postal entry route
We are a prize competition, not a gambling product. Anyone may enter any of our competitions for free by post, on equal terms with paid entrants. To use the free postal route, send an open postcard (not in an envelope) to:
OctoComps – Free Entry, PO Box 81810, London, E17 0DL
Each postcard must include your full name, full postal address, date of birth, contact telephone number, registered account email address, and the name of the Competition exactly as displayed on the Platform. Bulk entries on the same postcard will not be accepted. Full free postal entry rules are set out in our Terms and Conditions.
We process the personal data on your postal entry for the same purposes set out in section 5, and we apply the same age and eligibility checks.
7. Age, identity and responsible-play checks
We carry out the following checks to keep our competitions safe and fair:
- Age verification: we verify that you are 18 or over before allowing you to enter or to receive a prize. Where the information you give us is inconsistent or unclear we may ask you for additional documentation.
- Identity verification: before we release a prize we may ask you for documents (such as a passport, driving licence, recent utility bill or bank statement) so we can confirm that the prize is going to the right person and protect against fraud.
- Affordability indicators: where required, documents you provide may also be reviewed to support responsible-play affordability checks. This information is not used for marketing.
8. Cookies and similar technologies
We use cookies and similar technologies to make our website work, to keep you signed in, to operate our age-gate, to remember your basket and entries, to keep our service secure, and (with your consent) for analytics and advertising.
You can manage your preferences at any time using the cookie banner on our website or in your browser settings. Full details of every cookie we use, what it does and how long it lasts are set out in our Cookie Policy at www.octocomps.co.uk.
9. Marketing
We will only send you marketing where the law allows us to. In practice, that means: (a) where you have opted in (for example by ticking a box when you sign up or by signing up to our newsletter); or (b) where the soft opt-in applies and you have not opted out — that is, you are an existing customer, the marketing relates to our own similar competitions, and we gave you a clear chance to say “no” at the time we collected your details and in every message since.
We send marketing by email and SMS. SMS marketing is only ever sent on a clear opt-in basis.
You can opt out of marketing at any time by:
- Clicking the “unsubscribe” link in any marketing email;
- Replying STOP to any marketing SMS;
- Updating your preferences in your account; or
- Emailing us at contact@octocomps.co.uk.
Opting out of marketing will not stop us sending you service messages (such as entry confirmations, prize notifications, payment receipts and security alerts) — these are part of running your account.
10. Who we share your data with
We share personal data only where we need to. Our recipients fall into the following categories:
| Recipient category | What we share and why |
|---|---|
| Payment processing | Our payment provider for processing card payments and storing card details on our behalf. We never see or store your full card number. |
| Identity & age verification | Identity and age documents provided by you, shared with our verification provider as needed to confirm eligibility before releasing prizes. |
| Email / SMS marketing platform | Name and contact details, shared with our email and SMS delivery providers to send competition updates and marketing you have opted in to. |
| Hosting, cloud and infrastructure | Personal data is stored on servers managed by our cloud hosting provider, subject to UK-GDPR-compliant data processing agreements. |
| Analytics and advertising | Anonymised or pseudonymised usage data, shared with analytics and advertising providers only where you have given consent through our cookie banner. |
| Customer support tooling | Support correspondence shared with our helpdesk software provider to manage and respond to queries. |
| Prize fulfilment | Where prizes are physical, we share the winner’s name, address and contact details with the supplier or courier delivering the prize. Where prizes are cash, we share what is required to make the bank or wallet payment to you. |
| Professional advisers | Lawyers, accountants, auditors, insurers and other professional advisers under appropriate confidentiality obligations. |
| Regulators and authorities | The Information Commissioner’s Office, the Advertising Standards Authority (where required to evidence the proper conduct of a competition), HMRC, law enforcement, and other regulators or courts where we are legally obliged to do so. |
| Corporate transactions | If we are sold, restructured, or merge with another business, we may share data with the buyer/their advisers, who will be required to use it in line with this policy. |
We require everyone we share data with to keep it secure, to use it only for the purposes we have agreed, and to comply with applicable data protection law. We do not sell your personal data.
11. International transfers
Some of our service providers process data outside the UK, principally in the European Economic Area and the United States. Whenever we transfer personal data out of the UK we make sure an appropriate safeguard is in place, by relying on one of the following:
- A UK adequacy regulation or “data bridge” (for example, the UK extension to the EU–US Data Privacy Framework, where the receiving organisation is certified);
- The UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses where they apply; or
- Another lawful transfer mechanism recognised by the UK GDPR.
You can ask us for a copy of the safeguard we rely on for any specific transfer by emailing contact@octocomps.co.uk.
12. How long we keep your data
We only keep your personal data for as long as we need it. Our default retention periods are:
| Type of data | How long we keep it |
|---|---|
| Account data | For as long as your account is active, plus 6 years after closure (to deal with complaints, regulatory queries and possible legal claims). |
| Competition entry, transaction and prize records | 7 years from the end of the financial year of the entry, in line with HMRC and accounting requirements. |
| Identity and age-verification records | For as long as your account is active, plus 6 years. |
| Wallet and payment records | 7 years from the date of the last transaction. |
| Customer support correspondence | 3 years from the date the matter is closed (longer where there is a complaint or potential claim). |
| Marketing preferences and opt-out records | Indefinitely, so we can respect “do not contact” requests on an ongoing basis. |
| Marketing engagement data (e.g. opens, clicks) | Up to 3 years. |
| Website logs, analytics and cookie-derived data | Up to 26 months for analytics data; shorter periods for raw server logs. |
| Winner publicity content (photos, video, quotes) | For as long as we have a legitimate interest in promoting the competition outcome, subject to your right to object at any time. |
We may keep data for longer where we are required to by law (for example to defend a claim, to comply with a regulatory order, or to meet a tax obligation). Where we no longer need data we either delete it securely or anonymise it.
13. How we protect your data
We use appropriate technical and organisational measures to protect your personal data, including encryption in transit, hashed password storage, role-based access controls, audit logging, and security monitoring. We also restrict access to personal data on a need-to-know basis and require all staff and contractors to keep it confidential. If we suspect a personal data breach, we will investigate, contain it, and notify you and the ICO where the law requires us to.
14. Your rights
You have the following rights over your personal data, subject to the conditions set out in UK GDPR:
| Right | What it means |
|---|---|
| Right of access | Ask us for a copy of the personal data we hold about you. |
| Right to rectification | Ask us to correct or update inaccurate or incomplete data. |
| Right to erasure | Ask us to delete data where there is no good reason for us to keep it. |
| Right to restrict processing | Ask us to pause our processing in certain situations (e.g. while we check the accuracy of the data). |
| Right to object | Object to processing based on our legitimate interests; you can also object to direct marketing at any time, no questions asked. |
| Right to data portability | Ask us to give you, or another controller, the data you have given us in a structured, machine-readable format. |
| Right to withdraw consent | Where we rely on your consent, withdraw it at any time. This will not affect the lawfulness of anything we did before you withdrew it. |
| Right to complain | Lodge a complaint with the ICO (ico.org.uk) at any time. |
| Right not to be subject to solely automated decisions | We do not currently make decisions about you that have a legal or similarly significant effect using only automated processing. |
How to exercise your rights
To exercise any of the rights above, please email contact@octocomps.co.uk or write to us at OctoComps Ltd, PO Box 81810, London, E17 0DL. So that we can be sure we are dealing with the right person, we may ask you to verify your identity before we act on your request.
Your request is normally free of charge. We will respond within one calendar month, although for complex or multiple requests we may extend this by up to a further two months and will let you know. If we do not act on your request, we will explain why and tell you about your right to complain to the ICO.
15. Changes to this policy
We will keep this policy under regular review. When we make material changes we will let you know — for example, by posting an updated policy on our website and, where appropriate, by emailing you. Please check the “Last updated” date at the top of this policy to see when it was last revised.
16. Quick definitions
| Term | Meaning |
|---|---|
| Personal data | Any information that, on its own or combined with other information, can identify a living individual. |
| Processing | Anything we do with personal data — collecting, storing, using, sharing, deleting, etc. |
| Data controller | The organisation that decides how and why personal data is processed. OctoComps is the controller of your personal data under this policy. |
| Data processor | An organisation that processes personal data on behalf of a controller (e.g. our hosting provider). |
| UK GDPR | The retained EU General Data Protection Regulation as it forms part of UK law, alongside the Data Protection Act 2018. |
| PECR | The Privacy and Electronic Communications Regulations, which govern marketing by email, SMS, phone and similar channels, plus the use of cookies. |
— End of Privacy Policy —