Legal

Privacy notice

Last updated: 21 July 2026.

Controller: Laurence Caton, a sole trader, trading as PromoProof, Pickwicks Folly, Thorpe Lane, Trimley St Martin, IP11 0RZ, United Kingdom. Privacy contact: info@promoproof.co.uk. We are the controller for personal data we use to run our website, manage customer accounts, process orders, provide support and protect the service.

1. Our role for promotion data

When a customer imports entrant data into a PromoProof workspace, the customer normally decides why and how that information is used for its promotion. In that situation, the customer is the controller and PromoProof acts as its processor, using the data only to provide the agreed service and documented instructions. The customer is responsible for its entrant-facing privacy notice and for responding to entrant requests, unless law says otherwise.

2. Personal data we may use

• Account and workspace data: name, business details, email address, role, login information and activity records.
• Order and billing data: order details, plan, invoices, payment status and billing address. Card details are handled by the chosen payment provider, not stored by PromoProof unless explicitly stated at checkout.
• Support and communications: messages, requests, feedback and the information needed to resolve an issue.
• Customer-imported entrant data: fields selected by the customer, which may include a reference, name, email address, entry timestamp, quantity and eligibility status.
• Technical and security data: IP address, browser and device information, server logs, session identifiers and security events.

3. Why we use it

• To provide accounts, subscriptions, workspace access, evidence records and support.
• To process payments, prevent fraud, keep business records and enforce our agreement.
• To secure, maintain and improve the website and service.
• To comply with legal obligations and respond to valid requests from authorities.
• To send service communications. We only send direct marketing where permitted by law and give you a way to opt out.

We rely on contract performance, legitimate interests, legal obligations and consent where applicable. For customer-imported entrant data, the customer determines the appropriate lawful basis and provides our documented instructions.

4. Who receives data

We may share personal data with carefully selected providers that help us host, secure, maintain, communicate about, bill for or support PromoProof, and with professional advisers or authorities where necessary. We require processors to protect personal data and use it only for the services they provide to us.

We currently use Stripe for payment processing and Hostinger for website hosting, business email, backups and customer-support infrastructure. These providers may process data internationally; where a transfer is restricted, we will use the safeguards described in this notice.

5. International transfers

If personal data is transferred outside the UK or European Economic Area, we will use an appropriate transfer mechanism, such as an adequacy decision or approved contractual safeguards, and take supplementary measures where required.

6. Retention

We retain account, billing and support information for as long as needed for the account, our legal obligations and the resolution of disputes. Entrant-list imports are retained in line with the customer’s selected workspace plan and settings. PromoProof currently supports plan-based raw-import retention periods of 30, 90 or up to 180 days; evidence records may remain longer so the customer can retain a verifiable audit trail. The customer should export and manage its own retention requirements.

7. Your rights

Depending on the law that applies, you may ask to access, correct, erase, restrict or receive a copy of your personal data, object to certain processing, withdraw consent, or complain to a regulator. Account holders can contact us at info@promoproof.co.uk. Entrants should normally contact the promotion organiser first, because it controls the campaign and its entrant data.

8. Security and updates

We use proportionate technical and organisational measures to protect the service, but no system is completely risk-free. We may update this notice when our processing changes. Material changes will be communicated through the website, service or email where appropriate.