The Legal Bit

Privacy Policy

Welcome to Retro Wins Ltd's privacy policy.

Retro Wins Ltd respects your privacy and is committed to protecting your personal data. This policy explains how we process and look after your personal data when you visit our website and tells you about your privacy rights.

1. Important information and who we are

Purpose of this privacy policy

This policy explains how Retro Wins Ltd collects and processes personal data through your use of this website, including when you create an account, join our newsletter, enter a competition, make a payment or contact us.

This website is not intended for children and we do not knowingly collect data relating to children.

Controller

Retro Wins Ltd is the controller responsible for your personal data.

Contact details

Legal entity: Retro Wins Ltd
Company number: 17186014
Data privacy manager: Paul Purseglove
Email: hello@retrowins.co.uk
Postal address: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ

You have the right to complain to the Information Commissioner's Office. We would appreciate the chance to deal with your concerns first.

We keep this privacy policy under regular review. This version was last updated on 5 September 2026.

Your duty to inform us of changes

Please keep us informed if your personal data changes during your relationship with us.

Third-party links

Our website may include links to third-party websites, plug-ins and applications. We do not control those third parties and are not responsible for their privacy statements.

2. The data we collect about you

Personal data means information about an individual from which that person can be identified.

• Identity Data includes your first name, last name, username and date of birth.

• Contact Data includes your address, email address and telephone number.

• Financial Data includes payment information processed by our payment providers. We do not store your full payment card details.

• Transaction Data includes details about payments to and from you, competition entries, orders, site credit and prizes.

• Technical Data includes your IP address, login data, browser type and version, time zone, operating system, device and related technical information.

• Profile Data includes your username, password, purchases, entries, preferences and account settings.

• Usage Data includes information about how you use our website and services.

• Marketing and Communications Data includes your choices about receiving marketing and your communication preferences.

We may also collect and use aggregated data for statistical or analytical purposes. Aggregated data does not directly identify you.

We do not collect Special Categories of Personal Data about you, nor do we collect information about criminal convictions and offences.

We collect the minimum personal data needed to allow you to enter our competitions and for us to administer them. If you win, we may need additional information to verify your identity, eligibility or to deliver or transfer the prize.

If you fail to provide personal data

Where we need personal data by law or under a contract with you and you do not provide it, we may be unable to provide the relevant service or enter you into a competition.

3. How is your personal data collected?

We collect personal data through:

• Direct interactions, including when you create an account, enter a competition, join our newsletter, request marketing, contact us or provide feedback.

• Automated technologies, including cookies, server logs and similar technologies used when you interact with our website.

• Third parties, including analytics, advertising, hosting and payment service providers.

These third parties currently include Google Analytics, Meta, Klaviyo, Amazon Web Services and Cashflows, where applicable to the service being provided.

For more information about cookies, please see our Website Terms of Use and the cookie choices shown on our website.

4. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we use it:

• where we need to perform a contract with you;

• where it is necessary for our legitimate interests and your rights do not override those interests; or

• where we need to comply with a legal obligation.

We generally do not rely on consent as the legal basis for processing your personal data, except where consent is required for marketing or similar activities. You may withdraw marketing consent at any time.

Purposes for which we will use your personal data

If you win a competition, we may invite you to participate in publicity. Participation is not compulsory and declining will not affect your chance of winning. We may still be required to provide winner information to the Advertising Standards Authority where required.

Marketing

We strive to give you choices regarding marketing and advertising. You will only be subscribed to email or SMS marketing where you have made the relevant choice through our website or otherwise provided the necessary consent.

We will obtain your express opt-in consent before sharing your personal data with any third party for that third party's own marketing purposes.

You can ask us to stop sending marketing messages at any time by using the unsubscribe option in a marketing message or by contacting us.

Cookies

We use strictly necessary cookies to provide core functions such as login, security and shopping-cart functionality. Optional analytics and marketing cookies are only used where you have accepted them through our cookie choices.

If you refuse or block necessary cookies, parts of the website may not function properly. For more information, see our Website Terms of Use.

Change of purpose

We will only use your personal data for the purposes for which we collected it unless we reasonably consider that we need to use it for another compatible purpose. If we need to use your data for an unrelated purpose, we will notify you and explain the legal basis.

5. Disclosures of your personal data

We may share your personal data with service providers and other third parties where necessary for the purposes described in this policy. These may include:

• Amazon Web Services, for hosting and infrastructure;

• Cashflows, for payment processing;

• Klaviyo, for email and SMS marketing where enabled and where you have made the relevant marketing choice;

• Google, for analytics where optional cookies have been accepted;

• Meta, for advertising and measurement where optional cookies have been accepted;

• professional advisers such as lawyers, accountants, bankers, auditors and insurers;

• HM Revenue & Customs, regulators and other authorities where required; and

• third parties to whom we may choose to sell, transfer or merge parts of our business or assets.

We require third parties to respect the security of your personal data and to treat it in accordance with the law.

6. International transfers

Some of our external service providers are based outside the United Kingdom, so their processing of your personal data may involve a transfer outside the UK.

Whenever we transfer personal data outside the UK, we take steps to ensure an appropriate level of protection is provided, including by using countries recognised as providing an adequate level of protection or using contracts approved for use in the UK.

Please contact us if you would like further information about the specific safeguards used for an international transfer.

7. Data security

We use appropriate security measures to protect personal data against accidental loss, misuse, unauthorised access, alteration or disclosure.

Access to personal data is limited to people and service providers who have a business need to know it and who are required to handle it appropriately.

We have procedures for dealing with suspected personal data breaches and will notify you and any regulator where required by law.

8. Data retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including legal, regulatory, tax, accounting and reporting requirements.

We may retain data for longer where there is a complaint or a reasonable prospect of litigation.

We consider the amount, nature and sensitivity of the data, the risks of harm from misuse or disclosure, the purposes of processing and applicable legal requirements when deciding how long to keep it.

In some circumstances you can ask us to delete your data. We may also anonymise data for research or statistical purposes and use that anonymised information indefinitely.

9. Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data. If you wish to exercise any of these rights, please contact us.

• Request access to your personal data.

• Request correction of inaccurate or incomplete personal data.

• Request erasure of your personal data where there is no good reason for us to continue processing it.

• Object to processing where we rely on legitimate interests, and object to direct marketing.

• Request restriction of processing in certain circumstances.

• Request transfer of certain personal data to you or a third party.

• Withdraw consent at any time where we rely on consent.

No fee usually required

You will not usually have to pay a fee to exercise your rights. We may charge a reasonable fee or refuse a request if it is clearly unfounded, repetitive or excessive.

What we may need from you

We may request information to confirm your identity and ensure that personal data is not disclosed to someone who has no right to receive it.

Time limit to respond

We try to respond to legitimate requests within one month. It may take longer if a request is particularly complex or you have made several requests, in which case we will keep you informed.

10. Glossary

Lawful basis

Legitimate Interest means the interest of our business in conducting and managing our business to give you a good service and a secure experience. We balance those interests against any potential impact on your rights.

Performance of Contract means processing personal data where it is necessary to perform a contract with you or to take steps at your request before entering into a contract.

Comply with a legal obligation means processing personal data where it is necessary for compliance with a legal obligation that applies to us.

External third parties

External third parties may include IT and hosting providers, payment providers, marketing and analytics providers, professional advisers, HM Revenue & Customs, regulators and other authorities.

Your legal rights

Your legal rights include the rights of access, correction, erasure, objection, restriction, data portability and withdrawal of consent described in section 9 above.