Privacy Policy

1. Who We Are

Legion Comps ("we", "our", "us") is the data controller responsible for your personal data collected through this website.

2. What Personal Data We Collect

3. Why We Collect Your Data (Legal Basis)

4. Payment Processing

Card payments on Legion Comps are processed by DNA Payments, a PCI-DSS compliant specialist payment processor. When you pay by card, your card details are entered directly into DNA Payments' secure hosted checkout and transmitted directly to them — Legion Comps never receives, stores, or processes your card number, expiry date, or CVV.

If you pay by Open Banking (Pay by Bank), your payment is processed by TrueLayer, an FCA-authorised payment initiation service provider. You authorise the payment directly with your bank — we receive only a settlement confirmation.

Both DNA Payments and TrueLayer act as data processors on our behalf and are subject to UK GDPR. You can read DNA Payments' privacy policy at dnapayments.com/privacy-policy and TrueLayer's at truelayer.com/privacy.

Age Verification

Entry is restricted to those aged 18 or over. Normally we rely on the date of birth you provide when registering. In some cases — for example before dispatching a prize, or where we need to confirm eligibility — we may ask you to complete a secure age verification check.

That check is carried out by Stripe Identity, a specialist identity-verification provider acting as a data processor. Your identity document and any selfie are submitted to and processed by Stripe — Legion Comps never receives or stores your identity document. We retain only the outcome of the check (pass/fail) and a reference to the verification session. You can read Stripe's privacy policy at stripe.com/privacy.

5. How Long We Keep Your Data

• ▸Competition and transaction records (including draw logs, ticket records, and financial transactions) are retained for 7 years to comply with HMRC requirements and in case of legal dispute.
• ▸User profile data (name, email, date of birth) is retained for as long as you hold an account. If you request account deletion, your personal profile data will be deleted within 30 days, though anonymised competition records may be retained for legal compliance.
• ▸Technical/log data (IP addresses, server logs) is retained for up to 90 days for security purposes.

6. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• ▸Right of access: Request a copy of the personal data we hold about you.
• ▸Right to erasure: Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
• ▸Right to portability: Receive your data in a structured, machine-readable format.
• ▸Right to object: Object to processing based on legitimate interests.
• ▸Right to rectification: Request correction of inaccurate data.
• ▸Right to restrict processing: Request that we limit how we use your data while a dispute is resolved.

7. Data Sharing

We do not sell your personal data. We only share data with third parties where necessary:

• ▸DNA Payments / TrueLayer — payment processing (see section 4)
• ▸Courier/postal services — delivery address shared for prize dispatch only
• ▸Meta (Facebook/Instagram advertising) — only if you consent to advertising cookies. See section 8 for exactly what is shared and for how long we keep it
• ▸Legal and regulatory authorities — if required by law

8. Cookies

Legion Comps uses strictly necessary cookies to run the site, and — only where you give consent via the cookie banner — analytics and advertising cookies. The lawful basis for analytics and advertising cookies is your consent (PECR Regulation 6 and UK GDPR Article 6(1)(a)). No analytics or advertising cookie is set, and no tracking script loads, unless and until you consent.

Where you consent to analytics or advertising cookies, the associated data is shared with Google LLC and/or Meta Platforms Ireland Ltd respectively, who act as independent controllers for some of that processing.

Measuring adverts from our servers

If — and only if — you consent to advertising, we also send Meta a record of your purchase directly from our servers, rather than from your browser. This is Meta's Conversions API. We do it because browser-based measurement is often blocked, which would otherwise leave us unable to tell which adverts actually work.

What we send: your email address, phone number, name, town and postcode — each one irreversibly encoded (hashed) before it leaves our systems, so Meta cannot read the original values and uses them only to check for a match against an existing account. Alongside those we send your IP address, browser user-agent, the Meta cookie values above, the order total and the competitions entered. We never send your answers to competition questions.

Legal basis: your consent, under the same advertising permission as the cookies above. Withdrawing that consent stops all future sends. The advertising identifiers we hold for this purpose are stored against the order and are retained no longer than is necessary to report and reconcile the conversion — they are kept separately from the order record itself, which gambling regulation requires us to retain for longer. Meta acts as an independent controller for what it does with the data it receives; see the Meta privacy policy.

You can withdraw or change your consent at any time using the "Cookie settings" link in the page footer — withdrawing is as easy as giving consent. Session cookies expire when you close your browser or are automatically cleared after your session ends.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to registered users by email. The current version is always available on this page, with the date of last update shown at the top.