Privacy Policy

Effective date: 30 March 2026 · Link'dUp™

1. Who We Are

Link'dUp™ ("we", "us", "our") operates the website at officiallinkdup.com and runs prize competitions and entertainment content for UK and Ireland audiences. We are the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data We Collect

We collect the following categories of personal data in connection with our services:

• Competition entries: Full name, email address, date of birth, and your answer to the skill question
• Payment data: Processed securely by Square. We do not store card or bank details on our servers. Square's privacy policy governs their processing of payment data.
• Contact and enquiry forms: Name, email address, and the content of your message or enquiry
• Show applications: Name, contact details, social media handles, follower counts, and any other information you choose to provide
• Brand partnership enquiries: Contact name, company name, email address, and enquiry details
• Content participants: If you appear in Link'dUp™ content, we may hold audio-visual recordings, biographical information, and social media details
• Website usage: Anonymous analytics data including pages visited, time on site, and device type (collected via cookies — see our Cookie Policy)

3. How We Use Your Data and Our Lawful Basis

The table below sets out each processing activity, our purpose, and the UK GDPR Article 6 lawful basis we rely on:

• Processing and validating competition entries — Lawful basis: Contract performance (Article 6(1)(b)) — processing is necessary to administer the competition you have entered
• Notifying and fulfilling prizes for competition winners — Lawful basis: Contract performance (Article 6(1)(b)) — processing is necessary to award and deliver the prize
• Responding to contact form and general enquiries — Lawful basis: Legitimate interests (Article 6(1)(f)) — we have a legitimate interest in responding to communications sent to us
• Reviewing show applications — Lawful basis: Legitimate interests (Article 6(1)(f)) — we have a legitimate interest in considering applications to appear on our show
• Reviewing brand partnership enquiries — Lawful basis: Legitimate interests (Article 6(1)(f)) — we have a legitimate interest in considering commercial partnership opportunities
• Processing content participant data (filming and broadcast) — Lawful basis: Consent (Article 6(1)(a)) — obtained via a separate participant consent form prior to filming
• Sending marketing communications — Lawful basis: Consent (Article 6(1)(a)) — only where you have opted in; you may withdraw consent at any time
• Complying with legal obligations — Lawful basis: Legal obligation (Article 6(1)(c))
• Preventing fraud and securing our website — Lawful basis: Legitimate interests (Article 6(1)(f))

4. Data Sharing and Third-Party Processors

We do not sell your personal data. We share your data only with the following parties, and only to the extent necessary:

• Square: For secure payment processing in connection with competition entries. Square is an independent data controller for payment processing. Square's privacy policy is available at squareup.com/gb/legal/privacy.
• Netlify: Our website is hosted and form submissions are processed via Netlify, Inc. (a US-based company operating under standard contractual clauses for international data transfers). Netlify processes form submission data on our behalf as a data processor. Netlify's privacy policy is available at netlify.com/privacy.
• EmailJS: We use EmailJS (a US-based service) to send automated entry confirmation emails to competition entrants. EmailJS processes entrant first name and email address on our behalf solely for the purpose of delivering those confirmation emails. No other personal data is transmitted to EmailJS. EmailJS's privacy policy is available at emailjs.com/legal/privacy-policy.
• Microsoft (Outlook / Microsoft 365): Our business email is operated via Microsoft's Outlook service. Email communications you send to us (including via contact forms), and replies we send to you, are processed by Microsoft Corporation as a data processor. Microsoft's privacy policy is available at privacy.microsoft.com.
• Prize suppliers: If you win a competition involving travel, accommodation, or physical delivery, we will share your name and contact/delivery details with the relevant supplier solely to arrange prize fulfilment.
• Legal requirements: We may disclose your data where required by applicable law, court order, or to protect our legal rights.

5. Data Retention

We retain personal data only for as long as is necessary for the purpose for which it was collected:

• Competition entries (non-winners): 2 years from the competition closing date, then securely deleted
• Competition winner data: 7 years from the date the prize is fulfilled, for tax and accounting purposes
• Contact and general enquiries: 1 year from the date of your last communication with us
• Show applications: 12 months from submission, unless you are selected to appear on the show
• Content participant data: For the duration of the content's active publication, plus 2 years. You may request removal at any time (subject to our legitimate interest in maintaining an accurate broadcast record).
• Marketing consent records: Until you withdraw consent, plus a reasonable period thereafter to demonstrate we acted on your withdrawal

6. Your Rights

Under UK GDPR you have the following rights in relation to your personal data:

• Right of access (Subject Access Request): Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure ("right to be forgotten"): Request deletion of your data where there is no overriding legitimate reason for us to retain it
• Right to restriction of processing: Request that we limit how we use your data in certain circumstances
• Right to object: Object to processing based on legitimate interests; we will stop unless we can demonstrate compelling legitimate grounds
• Right to data portability: Receive your data in a commonly used, machine-readable format where processing is based on consent or contract
• Right to withdraw consent: Withdraw marketing consent at any time (this will not affect the lawfulness of processing before withdrawal)
• Rights related to automated decision-making and profiling: You have the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal or similarly significant effects concerning you. We do not carry out solely automated decision-making in connection with our services.

To exercise any of these rights, email us at hello@officiallinkdup.com. We will respond within 30 days (this may be extended by a further 2 months for complex requests, with notice).

7. Content Participants — Additional Rights

If you have appeared in or contributed to Link'dUp™ content:

• You have the right to request that we remove or restrict publication of content featuring you, subject to our legitimate interest in maintaining accurate broadcast and competition records
• You have the right to access any personal data held about you in connection with your participation
• Where your data is processed on the basis of consent, you may withdraw that consent at any time by contacting hello@officiallinkdup.com
• Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal

8. Cookies

We use cookies to ensure our website functions correctly and to understand how it is used. See our Cookie Policy for full details including a list of all cookies set and their purposes.

9. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or destruction. Our website is served over HTTPS. Payment data is handled exclusively by Square and is never transmitted to or stored on our servers.

10. International Transfers

Our website is hosted by Netlify (United States). Netlify participates in the EU-US Data Privacy Framework and uses standard contractual clauses approved by the UK Information Commissioner to ensure adequate protection for any personal data transferred outside the UK. For further details, see Netlify's privacy policy.

Entry confirmation emails are sent via EmailJS (United States). EmailJS uses standard contractual clauses for international transfers of personal data outside the UK. Only entrant first name and email address are transmitted to EmailJS for this purpose.

Email communications sent to and from our business email address are processed by Microsoft Corporation (United States) via Microsoft 365. Microsoft acts as a data processor and applies standard contractual clauses for international data transfers. For further details, see Microsoft's privacy policy at privacy.microsoft.com.

11. Third-Party Links

Our website contains links to third-party websites including YouTube, Instagram, TikTok, and Square. We are not responsible for the privacy practices of these third parties and encourage you to review their privacy policies independently.

12. Children

Our website and competitions are not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will delete it without delay.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law or our practices. The effective date at the top of this page reflects the most recent revision. Where changes are material, we will provide notice on our website or social media channels.

14. Your Right to Complain to the ICO

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) — the UK's independent data protection regulator.

ICO website: ico.org.uk
ICO helpline: 0303 123 1113
ICO address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Entrants in the Republic of Ireland may also contact the Data Protection Commission (DPC) at dataprotection.ie.

We would, however, appreciate the opportunity to address your concerns before you contact the regulator. Please email us at hello@officiallinkdup.com in the first instance.

15. Contact

For any privacy-related queries or to exercise your data rights, contact us at: hello@officiallinkdup.com