Privacy Policy

Arm Candy and Gear Digital Limited (the parent company) respects the privacy and security of any personal information you provide us when using our website and entering our competitions. This privacy policy explains the information we collect, why we collect it and how we use it. We never share your information (or data as you might call it) with third parties for them to market their products and services to you. If you have any questions about how we protect your privacy, please feel free to contact us at is the website owned by Gear Digital Limited, registered in the United Kingdom (Company Number 09512370), and registered at 7C Blackfriars House, Parsonage, Manchester, M3 2JA. Any references to “Arm Candy”, “we”, “us” or “our” is this policy means Gear Digital Limited.

When you use the Arm Candy website or deal with us on the phone, via email or however we interact, you may provide, or we may collect, information that would disclose your identity. We call this Personally Identifiable Information, or Personal Data. Regarding the General Data Protection Regulation (or GDPR as it is known for short), we are the “Data Controller” and you are the “Data Subject”. In short, this means we are responsible for determining how your personal data is used, how it is kept safe and ensuring that it is only used for the legitimate reasons it was collected for.

We are 100% committed to protecting your privacy. We will take all necessary steps to comply with the law and GDPR when using your personal data. This policy explains how we achieve this. Please read it carefully.

What will you learn from this Privacy Policy?

  1. The personal data we collect or you provide to us when using our website or interacting with us in other forms of communication, including meeting our team to accept prize deliveries.
  2. How and why we use this personal data and the legitimate reasons we are allowed to do so by law.
  3. Who we share this personal data with.
  4. Your rights regarding your personal data and how you can exercise them.
  5. How you can contact us if you have any issues or want to discover more information about how we are processing personal data.

The personal data we collect and how we use it

You may provide us with the following types of personal information when you register with Arm Candy or otherwise when you directly interact with us (when using our website or otherwise):

Personal Identity Title, first name, surname, date of birth and country of residence
Contact Information Email, mobile, telephone number and address
Payment Details Card details, billing address and Arm Candy purchase history
Marketing Preferences Whether or not you wish to receive information and news from Arm Candy via Email
Arm Candy Account Details Arm candy login password

Use of cookies and Pixel Tags

Cookies are files sent by a web server to your computer for the purpose of archiving. This is standard in the trade, used by most websites and helps to simplify your continuous access to our website and its use. Cookies do not cause any damage to your computer system or to your files. Only the website that sent a specific cookie can read, modify or delete it. If you do not want this information to be stored using cookies, most browsers have simple methods enabling the deletion of any cookies stored, the automatic rejection of cookies or the selection between acceptances or rejection of a specific cookie sent to your computer. You should note that rejecting cookies makes it difficult or impossible for you to 'use' some parts of a website.

Under certain conditions, non-individualised technical information can be stored automatically in cookies, whether you register with our site or not, just through your use of it. This concerns the device you are operating, the type of internet browser you’re using, your operating system and the domain of the website from which you reached our website.

Our website may use so-called 'pixel tags', 'web beacons', 'clear GIFs' or similar aids (commonly termed as 'pixel tags') to gather basic statistical data on the use of the website and reaction quotas. Pixel tags allow us to count the number of users who have visited certain pages on the website, and help us analyse the effectiveness of our advertising campaigns. When we use pixel tags in the form of HTML-formatted email messages, we can determine whether and when an email was opened.

The Lawful Basis for Using Your Data

We will only use your Personal Data for the purpose we have collected it, and more importantly, only on a lawful basis. We record the Lawful Basis for which we use any Personal Information as part of our Data Protection auditing. It might be that we process your personal data for more than one reason, and in these instances, we will record all relevant lawful basis’. The following table shows how we use your personal data and our lawful basis for doing so.

Reason for useThe data usedLawful basis for use
Register you with Arm Candy Personal Identity, Contact Information, Marketing Preferences Contract
Enable your Arm Candy Account Personal Identity, Contact Information, Arm Candy Account Details Contract
Allow you to enter the competition Personal Identity, Contact Information, Payment Details Contract
Process your payments online Personal Identity, Contact Information, Payment Details Contract
Deliver your handbag if you win Personal Identity, Contact Information, Marketing Preferences, Payment Details, Arm Candy Account Details Contract
Legal Obligation
Legitimate Interest (To operate the service effectively)
Notify you of changes to our terms and conditions, this privacy policy or the Arm Candy competition Personal Identity, Contact Information Contract
Legal Obligation
Answer your enquiries Personal Identity, Contact Information Legitimate Interest (To operate the service effectively)
Email you with Arm Candy news and information Personal Identity, Contact Information, Marketing Preferences Legitimate Interest (To increase our engagement with our customers, to develop our competitions and our business)
Verify who you are, to detect fraud and security issues Personal Identity, Contact Information, Marketing Preferences, Payment Details Legitimate Interest (to detect and prevent fraudulent use of our website and to increase its security)
Advertising you as a winner Personal Identity (name and likeness only), Contact Information (location only) Legitimate Interest (to operate the service effectively and to promote trust in the competition)

To comply with GDPR and the law, we will only use your personal data for the purposes we have collected it. If we have a legitimate and lawful basis to use it for any other reason, we will notify you beforehand to explain what these are. We may at some point anonymise the personal data stored in our system, for example if you haven’t played for a long period of time. This will mean that you can no longer be identified in our system, but that data related to your entries (such as number of plays and tickets bought) can be aggregated and used in our data analysis, testing and research. Anonymised data is not personally identifiable, and therefore we can lawfully use this for any purposes we see fit.

Sharing your data with third parties

Firstly, and most importantly, we do not pass your personal data onto third parties for them to market their products and services to you. If this ever changes in the future, we will only do so with your consent.

If you’re an Arm Candy winner, your name, location and likeness (winners photograph) is shared with third parties who assist us with our marketing and advertising. You may have discovered the Arm Candy website by reacting to an advert showing a competition winner with their handbag, their name and city/town location.

If you’re an Arm Candy tie-breaker and you receive a runner-up prize, your name and address may be shared with third-parties who assist us with delivering your prize. For example, if you are sent a shopping voucher via post from a retailer, your information may have been entered into their website in order to compete this delivery.

When you are registering with the Arm Candy website, the data you input is shared with 4STOP, our ‘Know Your Customer’ (KYC) and Risk Management partners to assist us in checking that this data isn’t known to be used in fraudulent or criminal activities. 4STOP only use the data to check its legitimacy, and do not store it thereafter.

When you are registering with the Arm Candy website, the address data you input is verified with GetAddress(IO), our Address Verification partners. Their systems only use the data to validate its accuracy, and they do not store it thereafter.

Other aspects of our service delivery, such as processing your payments requires us to securely pass your payment details to our credit and debit card payment partners (clearly labelled on the card payment screen). Their systems only use the data to validate your payment, and they do not store it thereafter.

With your consent, if we ever share personal data with third parties, we will ensure that their access is strictly limited to the purpose for which it is being shared, and is subject to suitable obligations relating to confidentiality and security. Please note that certain of these third-party service providers use cookies or other tracking technologies

We may be required to share your personal data with third parties as a legal obligation, to assist in law or regulation. In these circumstances, we will ensure that the disclosure is limited to the extent required to meet the legal obligation.

Sending your data outside the European Economic Area (EEA)

If a service provider we use is outside of the EEA, we will ensure that your data is used fairly and lawfully. We would only allow this use if we have legal grounds to do so, and we are satisfied that the necessary safeguards to protect your personal data are in place. Should this sharing be necessary, we will make available to you copies of the safeguards we have put in place.

How do we secure your data?

We adopt industry standard security processes to ensure your personal data is handled securely and to prevent unauthorised access, processing or loss. We use secure server software (SSL) to encrypt all information you input before it is sent to us, and we ensure that any third parties who handle your data on our behalf (as documented above) are subject to the necessary confidentiality and security standards. Despite these security measures, the transmission of data via the internet cannot be guaranteed as completely secure. Information transmitted to us via the internet is therefore at your own risk.

How long do we store your data?

If you have registered with Arm candy and created an Account with us, we will store your data for as long this account exists. If you have played the Arm Candy competition as a guest, we will store your entries as part of our data records (to assist with our analysis and statistics). If your engagement with Arm Candy lapses, such that you have entered a competition as a guest then not played again within 6 months, we will anonymise your data so that you cannot be personally recognised in our system. If you no longer wish to engage with Arm Candy, we may still need to store your data if there is a legal reason for us to do so. For example, this might be in order to resolve an open dispute with you.

Links to Social Media websites

Our website links to our social media portals; Facebook, YouTube, Instagram and Twitter. It also allows you to share your competition entries via Facebook and Twitter. If you choose to leave our website and engage with these portals, we do not have any control over these third-party websites, and therefore cannot be held responsible for the protection and privacy of any personal data which you share with them, or input into them. Your use of these third-party websites is not governed by our Privacy Policy, and therefore we recommend you familiarise yourself with theirs.

What if we change this Privacy Policy?

If we make changes to this Privacy Policy, we will publish the amended policy on the website immediately thereafter and update the ‘last updated’ date to reflect this. If a change is considered to be substantial in so much as it may affect your decision to continue to engage with us, we may decide to inform you by email so that we can be more certain that you have been informed.

What are your rights as a Data Subject?

As a Data Subject, GDPR states that you are entitled to the following:

  • A copy of your personal data should this be requested by you;
  • The right for your personal data to be correct within our systems;
  • The right to update your personal data. Account holders can do manage their personal data by logging into their account. Guest users can contact us at to inform us of changes in their personal data;
  • The right to have your data personal data deleted from our systems. In such circumstances, we may anonymise your personal data so that you cannot be recognised, in order to retain the necessary information we use to analyse and report on statistics to assist in running our business;
  • The right to object to us processing your personal data where we are doing so with the lawful basis defined as a legitimate interest (as documented in the table above);
  • The right to restrict the processing of your personal data to specific uses;
  • The right to request that your personal data is transferred to a third party;
  • The right to withdraw any consent you have given us to process your personal data (unless we have legitimate legal grounds to continue this processing, whereby the lawful basis for processing would pass from consent to legal obligation).

If you want to exercise any of these rights, please contact us using the contact information provided below. Exercising your rights is free of charge whilst this considered to be reasonable. If your requests are considered unreasonable, without legitimate cause, repetitive or excessive, we may refuse to process such requests and seek legal counsel, or charge you a reasonable fee to cover the time taken to process your requests. Where your request is legitimate, we will respond within one month (unless there is a legal reason for us to take longer). We may need you to confirm your identity to us before we can process your request, if we cannot establish who you are.

Special Note for Parents

We do not intentionally market to children, and entry to our competition is restricted to adults (those aged 18 years and above). We have included ‘Know Your Customer’ (KYC) verification into our entry form to aid our verification of players identities, which in turn, assists in our restriction of use by children.We encourage all parents to instruct their children on the safe and responsible use of the Internet.

How to opt out of Arm Candy Email marketing

You can opt-out of Email marketing at any time either by using the opt-out function provide in our marketing emails, or if you are an Account Holder, by updating your preferences in the community page in your Account area. If you opt out of marketing, your email will be removed from our marketing list, and you will no longer receive news, information and promotions. You will however still receive service notifications by email for example if you play the competition, or emails that we send to comply with this privacy policy (such as informing you of a significant change in handling your personal data).

We do not pass your data onto any third parties for their marketing purposes. However, if we ever wish to do so in the future we will always get your consent. You can then opt-out from any third-party marketing at any time following the same process as above.

Contact Us

If you would like to discuss anything in this policy or if you want to exercise your rights, please get in touch:


Please write to us at:

The Data Protection Officer
Arm Candy
C/O Gear Digital Limited

7C Blackfriars House
M3 2JA

Telephone: 0161 818 7110