Arm-candy.co.uk is the website owned by Gear Digital Limited, registered in the United Kingdom (Company Number 09512370), and registered at 7C Blackfriars House, Parsonage, Manchester, M3 2JA. Any references to “Arm Candy”, “we”, “us” or “our” is this policy means Gear Digital Limited.
When you use the Arm Candy website or deal with us on the phone, via email or however we interact, you may provide, or we may collect, information that would disclose your identity. We call this Personally Identifiable Information, or Personal Data. Regarding the General Data Protection Regulation (or GDPR as it is known for short), we are the “Data Controller” and you are the “Data Subject”. In short, this means we are responsible for determining how your personal data is used, how it is kept safe and ensuring that it is only used for the legitimate reasons it was collected for.
We are 100% committed to protecting your privacy. We will take all necessary steps to comply with the law and GDPR when using your personal data. This policy explains how we achieve this. Please read it carefully.
- The personal data we collect or you provide to us when using our website or interacting with us in other forms of communication, including meeting our team to accept prize deliveries.
- How and why we use this personal data and the legitimate reasons we are allowed to do so by law.
- Who we share this personal data with.
- Your rights regarding your personal data and how you can exercise them.
- How you can contact us if you have any issues or want to discover more information about how we are processing personal data.
The personal data we collect and how we use it
You may provide us with the following types of personal information when you register with Arm Candy or otherwise when you directly interact with us (when using our website or otherwise):
|Personal Identity||Title, first name, surname, date of birth and country of residence|
|Contact Information||Email, mobile, telephone number and address|
|Payment Details||Card details, billing address and Arm Candy purchase history|
|Marketing Preferences||Whether or not you wish to receive information and news from Arm Candy via Email|
|Arm Candy Account Details||Arm candy login password|
Cookies are files sent by a web server to your computer for the purpose of archiving. This is standard in the trade, used by most websites and helps to simplify your continuous access to our website and its use. Cookies do not cause any damage to your computer system or to your files. Only the website that sent a specific cookie can read, modify or delete it. If you do not want this information to be stored using cookies, most browsers have simple methods enabling the deletion of any cookies stored, the automatic rejection of cookies or the selection between acceptances or rejection of a specific cookie sent to your computer. You should note that rejecting cookies makes it difficult or impossible for you to 'use' some parts of a website.
Under certain conditions, non-individualised technical information can be stored automatically in cookies, whether you register with our site or not, just through your use of it. This concerns the device you are operating, the type of internet browser you’re using, your operating system and the domain of the website from which you reached our website.
Our website may use so-called 'pixel tags', 'web beacons', 'clear GIFs' or similar aids (commonly termed as 'pixel tags') to gather basic statistical data on the use of the website and reaction quotas. Pixel tags allow us to count the number of users who have visited certain pages on the website, and help us analyse the effectiveness of our advertising campaigns. When we use pixel tags in the form of HTML-formatted email messages, we can determine whether and when an email was opened.
The Lawful Basis for Using Your Data
We will only use your Personal Data for the purpose we have collected it, and more importantly, only on a lawful basis. We record the Lawful Basis for which we use any Personal Information as part of our Data Protection auditing. It might be that we process your personal data for more than one reason, and in these instances, we will record all relevant lawful basis’. The following table shows how we use your personal data and our lawful basis for doing so.
|Reason for use||The data used||Lawful basis for use|
|Register you with Arm Candy||Personal Identity, Contact Information, Marketing Preferences||Contract|
|Enable your Arm Candy Account||Personal Identity, Contact Information, Arm Candy Account Details||Contract|
|Allow you to enter the competition||Personal Identity, Contact Information, Payment Details||Contract|
|Process your payments online||Personal Identity, Contact Information, Payment Details||Contract|
|Deliver your handbag if you win||Personal Identity, Contact Information, Marketing Preferences, Payment Details, Arm Candy Account Details||Contract
Legitimate Interest (To operate the service effectively)
|Answer your enquiries||Personal Identity, Contact Information||Legitimate Interest (To operate the service effectively)|
|Email you with Arm Candy news and information||Personal Identity, Contact Information, Marketing Preferences||Legitimate Interest (To increase our engagement with our customers, to develop our competitions and our business)
|Verify who you are, to detect fraud and security issues||Personal Identity, Contact Information, Marketing Preferences, Payment Details||Legitimate Interest (to detect and prevent fraudulent use of our website and to increase its security)|
|Advertising you as a winner||Personal Identity (name and likeness only), Contact Information (location only)||Legitimate Interest (to operate the service effectively and to promote trust in the competition)
To comply with GDPR and the law, we will only use your personal data for the purposes we have collected it. If we have a legitimate and lawful basis to use it for any other reason, we will notify you beforehand to explain what these are. We may at some point anonymise the personal data stored in our system, for example if you haven’t played for a long period of time. This will mean that you can no longer be identified in our system, but that data related to your entries (such as number of plays and tickets bought) can be aggregated and used in our data analysis, testing and research. Anonymised data is not personally identifiable, and therefore we can lawfully use this for any purposes we see fit.
Sharing your data with third parties
Firstly, and most importantly, we do not pass your personal data onto third parties for them to market their products and services to you. If this ever changes in the future, we will only do so with your consent.
If you’re an Arm Candy winner, your name, location and likeness (winners photograph) is shared with third parties who assist us with our marketing and advertising. You may have discovered the Arm Candy website by reacting to an advert showing a competition winner with their handbag, their name and city/town location.
If you’re an Arm Candy tie-breaker and you receive a runner-up prize, your name and address may be shared with third-parties who assist us with delivering your prize. For example, if you are sent a shopping voucher via post from a retailer, your information may have been entered into their website in order to compete this delivery.
When you are registering with the Arm Candy website, the data you input is shared with 4STOP, our ‘Know Your Customer’ (KYC) and Risk Management partners to assist us in checking that this data isn’t known to be used in fraudulent or criminal activities. 4STOP only use the data to check its legitimacy, and do not store it thereafter.
When you are registering with the Arm Candy website, the address data you input is verified with GetAddress(IO), our Address Verification partners. Their systems only use the data to validate its accuracy, and they do not store it thereafter.
Other aspects of our service delivery, such as processing your payments requires us to securely pass your payment details to our credit and debit card payment partners (clearly labelled on the card payment screen). Their systems only use the data to validate your payment, and they do not store it thereafter.
We may be required to share your personal data with third parties as a legal obligation, to assist in law or regulation. In these circumstances, we will ensure that the disclosure is limited to the extent required to meet the legal obligation.
Sending your data outside the European Economic Area (EEA)
If a service provider we use is outside of the EEA, we will ensure that your data is used fairly and lawfully. We would only allow this use if we have legal grounds to do so, and we are satisfied that the necessary safeguards to protect your personal data are in place. Should this sharing be necessary, we will make available to you copies of the safeguards we have put in place.
How do we secure your data?
We adopt industry standard security processes to ensure your personal data is handled securely and to prevent unauthorised access, processing or loss. We use secure server software (SSL) to encrypt all information you input before it is sent to us, and we ensure that any third parties who handle your data on our behalf (as documented above) are subject to the necessary confidentiality and security standards. Despite these security measures, the transmission of data via the internet cannot be guaranteed as completely secure. Information transmitted to us via the internet is therefore at your own risk.
How long do we store your data?
If you have registered with Arm candy and created an Account with us, we will store your data for as long this account exists. If you have played the Arm Candy competition as a guest, we will store your entries as part of our data records (to assist with our analysis and statistics). If your engagement with Arm Candy lapses, such that you have entered a competition as a guest then not played again within 6 months, we will anonymise your data so that you cannot be personally recognised in our system. If you no longer wish to engage with Arm Candy, we may still need to store your data if there is a legal reason for us to do so. For example, this might be in order to resolve an open dispute with you.
Links to Social Media websites
What are your rights as a Data Subject?
As a Data Subject, GDPR states that you are entitled to the following:
- A copy of your personal data should this be requested by you;
- The right for your personal data to be correct within our systems;
- The right to update your personal data. Account holders can do manage their personal data by logging into their account. Guest users can contact us at firstname.lastname@example.org to inform us of changes in their personal data;
- The right to have your data personal data deleted from our systems. In such circumstances, we may anonymise your personal data so that you cannot be recognised, in order to retain the necessary information we use to analyse and report on statistics to assist in running our business;
- The right to object to us processing your personal data where we are doing so with the lawful basis defined as a legitimate interest (as documented in the table above);
- The right to restrict the processing of your personal data to specific uses;
- The right to request that your personal data is transferred to a third party;
- The right to withdraw any consent you have given us to process your personal data (unless we have legitimate legal grounds to continue this processing, whereby the lawful basis for processing would pass from consent to legal obligation).
If you want to exercise any of these rights, please contact us using the contact information provided below. Exercising your rights is free of charge whilst this considered to be reasonable. If your requests are considered unreasonable, without legitimate cause, repetitive or excessive, we may refuse to process such requests and seek legal counsel, or charge you a reasonable fee to cover the time taken to process your requests. Where your request is legitimate, we will respond within one month (unless there is a legal reason for us to take longer). We may need you to confirm your identity to us before we can process your request, if we cannot establish who you are.
Special Note for Parents
We do not intentionally market to children, and entry to our competition is restricted to adults (those aged 18 years and above). We have included ‘Know Your Customer’ (KYC) verification into our entry form to aid our verification of players identities, which in turn, assists in our restriction of use by children.We encourage all parents to instruct their children on the safe and responsible use of the Internet.
How to opt out of Arm Candy Email marketing
We do not pass your data onto any third parties for their marketing purposes. However, if we ever wish to do so in the future we will always get your consent. You can then opt-out from any third-party marketing at any time following the same process as above.
If you would like to discuss anything in this policy or if you want to exercise your rights, please get in touch:
Please write to us at:
The Data Protection Officer
C/O Gear Digital Limited
7C Blackfriars House
Telephone: 0161 818 7110
LAST UPDATED: AUGUST 2018