Legal

Data processing information

Last updated: 21 July 2026.

This page describes the expected data-processing relationship when a customer supplies personal data to PromoProof for its own promotion. It is information only and does not replace a signed data processing agreement where one is required.

1. Roles

For entrant data you import, you normally act as controller because you determine the promotion, the entrants, the data fields, the retention period and the purpose of processing. Laurence Caton, a sole trader, trading as PromoProof, acts as processor and processes that data solely to provide the evidence service and on your documented instructions, unless required by law.

2. Processing details

• Subject matter and duration: workspace access, entrant import, validation, list freezing, winner-selection evidence and export for the duration of the customer’s use and agreed retention settings.
• Nature and purpose: to help the customer record and evidence a selection from an entrant list it provides for a free-to-enter promotion.
• Data subjects: entrants, prospective winners, customer users and, where relevant, client contacts.
• Personal data: identifiers and campaign-entry fields selected by the customer, such as a reference, name, email address, timestamp, entry quantity and eligibility notes.

3. Customer responsibilities

• Provide lawful documented instructions and ensure the promotion has an appropriate privacy notice and lawful basis.
• Use data minimisation, maintain accuracy and determine eligibility before finalising the entrant list.
• Handle data-subject requests, complaints, winner contact and all decisions about the promotion.
• Only invite authorised workspace users and promptly remove access that is no longer needed.

4. Processor commitments

Subject to a final signed agreement, PromoProof will use appropriate security measures, limit access to authorised people, assist with reasonable controller requests where required, use sub-processors under written protections, notify the customer of a relevant personal-data breach without undue delay, and delete or return data at the end of the service where applicable.

5. Sub-processors and transfers

PromoProof may use hosting, storage, support, security, payment and communications suppliers to provide the service. The active sub-processor list, processing locations and transfer safeguards must be confirmed before publication and included in the signed data processing agreement where required.

6. Requesting a data processing agreement

Customers that need a signed data processing agreement should contact info@promoproof.co.uk before importing entrant data. We will provide the current agreement and supplier information for review.