Privacy Notice

Winner People Customer Privacy Notice

1. What’s in this policy?

a. This policy covers the services offered by Winner People.

It tells you:

  • How we collect your information
  • What types of information we might collect about you
  • How we might use that information
  • The lawful bases for our collecting information
  • How long we keep information
  • Where we store information
  • Who we share information with
  • How we keep information secure
  • Your rights and how to complain

b. Who is responsible for your personal data

For the purposes of UK data protection law, Winner People Ltd, a company incorporated in Cyprus, is the data controller responsible for your personal data.

Winner People Ltd determines how and why your personal data is collected and used when you access or use the Winner People platform, website and services.

If you have any questions about this Privacy Notice or how your personal data is handled, you can contact us using the details set out in Section 12 below.

2. How do we collect your information?

The information we collect depends on how you use our platform and interact with us. We may collect information about you and your use of our services (referred to in the UK data protection legislation as your ‘Personal Data’) in the following ways:

A. Information you provide to us directly

We collect personal information when you create an account, subscribe to our platform, purchase access to digital content, complete forms on our website, communicate with our support team, respond to surveys, or otherwise interact with us (including via email, our website, or any promotional or feedback activities). If the purpose for collecting certain information is not obvious, we will explain it at the point of collection.

Section 3 provides more detail on the types of information we collect.

B. Information collected automatically when you use our platform

When you access our website or use our services, we automatically record certain information about your activity and device. This includes details of how you interact with our content, clicks and page views, your IP address, device information, browser type, and information about your internet connection. We collect this through log data, cookies and similar technologies. Please see our Cookie Notice for further information.

C. Information we infer about you

We may analyse the information we have about your use of the platform to draw insights or make predictions about your preferences or patterns of engagement (“Inferred Information”). For example, we may consider which content you view, how long you spend on certain pages, how frequently you visit, and the type of device you use. We do not infer or profile any sensitive information about you.

D. Information we collect when you interact with us via third-party platforms

If you choose to interact with us through social media or other third-party services — for example, by liking or commenting on our posts, sharing our content, signing up to our mailing list through a social platform, or messaging us — we may receive information about you from that platform. What we receive depends on the platform’s privacy settings and the choices you make.

E. Information collected from other third parties

We may receive information about you from trusted third parties that help us operate, develop or improve our platform. For example: analytics or measurement providers that gather information about how users engage with our content; payment processors that confirm transaction details; customer support platforms that manage communications on our behalf; or social media platforms that notify us when you engage with our content or mention our brand.

These third parties act in accordance with their own Privacy Notices and the permissions you have set with them.

3. What types of personal information does Winner People collect about you?

When we collect information from you, we will you details about why we need your personal information and how we’ll use it before you begin (unless this is obvious from the context).

a. Information that you give us

When you subscribe for a Winner People account or update your details, we ask for some personal information, like your name, email address and age.

We might also ask for your contact details, your address, your date of birth or payment details (processed securely by our payment provider—we do not store your full card number or security code), depending on what you’re doing.

We may collate information relating complaints or other feedback, to help us refine and develop our services.

When you call us, we may record the call for training for training, quality assurance, and service improvement purposes, including staff training, supervision, and the investigation of complaints. We will always let you know first if a call is being recorded.

Children’s data

The Winner People platform is intended for users aged 18 and over. We do not knowingly collect or process personal data relating to children under the age of 18.

If we become aware that we have collected personal data from a child under 18 without appropriate authorisation, we will take steps to delete that information as soon as reasonably practicable.

Where age information is collected, it is used solely to confirm eligibility to access the platform and to comply with our legal and contractual obligations.

b. Device information

Devices are lots of things like:

  • your computer
  • your mobile
  • your tablet
  • your voice-enabled device

We automatically collect some technical information from these devices and web browsers even when you’re not signed in to a Winner People account. This might include:

  • IP (internet protocol) address
  • device ID
  • app ID
  • vendor ID
  • advertising ID

c. Location Information

We collect information about your location when you use our products and services. This helps us to determine whether you’re somewhere where are services are available, helps us to ensure we are fulfilling our obligations and to offer additional features whilst using our products and services.

Your location can be determined at a town or city level by:

  • GPS
  • IP address
  • Information about nearby cell towers and Wi-Fi access point information

What type of location data (for example Country, Region, City or Town) is collected depends on the product or service your using, the device you’re using (for example Apple or Android) and your devices settings (whether permissions are enabled or disabled). You can change your permissions on or off any time in your device’s settings.

4. Our “lawful basis” for using your personal information

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information (the legislation refers to this as ‘processing’ of ‘personal data’). There is a list of possible lawful bases within Article 6(1) of the UK GDPR. You can find out more about these lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website.

Our lawful bases for collecting or using personal information to provide services and goods, operate customer accounts, deal with queries or complaints and for service updates and marketing purposes  are:

  • Consent – we have clear permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object to processing of your personal data. To be clear, you do have the right to withdraw your consent at any time.
  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – we’re collecting or using your information because it is necessary in order to benefit you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our Legitimate Interests are:
  • We rely on Legitimate Interests to operate and improve our platform, manage customer accounts, and provide secure access to our digital content and services. This includes processing account details, payment information and usage data so we can administer subscriptions, prevent unauthorised access, respond to enquiries and ensure the service functions properly. We also rely on Legitimate Interests when handling queries, complaints or claims, and may rely on performance of a contract where an issue relates directly to a customer’s subscription or use of the service. If we are legally required to retain or share information — for example, to handle a legal claim, prevent fraud or comply with regulatory obligations — we rely on the lawful basis of Legal Obligation. For marketing, we rely on legitimate interests to contact existing subscribers about similar services in line with the soft opt-in under PECR, and rely on consent for marketing to non-customers. Individuals can opt out or withdraw consent at any time.

For more information on our use of Legitimate Interests as a lawful basis you can contact us using the contact details below.

Most of the processing we carry out is based on Legitimate Interests or Contract.

5. How long will Winner People keep your personal information?

We only hold your information for as long as we have a valid reason to do so. Following legal guidance and best practice, below is a guide to how long we hold onto different types of information:

  • Account information: will be deleted within 90 days of a customer closing their account
  • Payment and transaction records: will be retained for 6 years
  • Customer support communications: will be retained for 12 months
  • Technical logs and analytics data: Will be anonymised after 180 days

After these periods, we permanently delete or fully anonymise your personal information.

6. Where we store your information

International transfers
           

We are based in Cyprus, and our primary systems and servers are located within the European Economic Area (EEA) or in countries recognised by the UK Government as providing an adequate level of data protection under UK GDPR.

This means that if you are located in the UK, your personal information will be transferred outside the UK.

The UK Government has recognised all EU/EEA countries, including Cyprus, as providing an adequate level of data protection. This means personal information can be transferred to and stored in these countries without additional transfer safeguards such as Standard Contractual Clauses.

Some of our third-party service providers (for example, email, analytics or payment processors) may store or process personal information in other countries. Where this occurs, we ensure that appropriate safeguards are in place in accordance with UK GDPR, which may include:

• a UK adequacy decision; or
• Standard Contractual Clauses (SCCs) and/or the UK International Data Transfer Addendum (IDTA).

You can contact us for further information about how the safeguards we use to protect personal information transferred internationally.

7. When we share your information

Who we share your information with and why

We share personal information with trusted service providers who help us operate our platform, including:
• Payment processors (e.g., Stripe) who process subscription payments and manage billing.
• Cloud hosting providers that store and run our website and platform.
• Email and communication providers that send account-related emails and notifications.
• Analytics and security tools that help us understand how our platform is used and keep it secure.
• Customer support tools used to respond to enquiries.
• Professional advisers (such as accountants and lawyers) where necessary for legal and financial compliance.
• Regulators or law enforcement where required by law.

These service providers act on our instructions and are not permitted to use your information for their own purposes.

8. How we keep your personal information secure

We are strongly committed to keeping your personal information safe and design our systems and services with your security and privacy in mind.

We use a combination of technical, organisational and physical safeguards to protect your information against loss, misuse and unauthorised access, disclosure, alteration or destruction.

These measures include staff training, strict data handling procedures, encryption protocols during transmission, and adherence to recognised standards such as the Payment Card Industry Data Security Standard (PCI DSS) when processing payment information.

We also require our service providers to implement appropriate security measures.

However, no online service or method of data transmission can guarantee absolute security. You are responsible for keeping your account credentials confidential and securing your devices against unauthorised access.

If you have any concerns that your account or personal information may have been compromised – such as someone discovering your password – please contact us immediately using the details provided below.

9. Your rights

You have several rights and choices under UK data protection law regarding the personal information we hold about you.

To exercise any of these rights, please follow the instructions provided or contact us in writing using the details below. To protect your information from unauthorised access, we may (where permitted by law) ask you to verify your identity before processing your request – for example, when you request access to, or deletion of your information.

You may also appoint an authorised agent to submit a request on your behalf; please ensure that their authority is clearly indicated when the request is made.

We will not treat you differently or unfairly for exercising your rights.

Please note that we may refuse certain requests, or fulfil them only in part, where we are legally entitled or required to do so, and some requests may be subject to specific exceptions under applicable law.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

10. How to complain

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the end of this Privacy Notice.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:          

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

11. Changes to this policy

This Privacy Notice was most recently updated in January 2026. It may be updated from time to time to reflect changes in law, ICO guidance and best practice, or in our own practices regarding the treatment of personal information.

You are advised to check this policy frequently for updates.

12. Contact us

We have appointed a Data Protection Lead (DPL) in the UK, who is responsible for overseeing questions in relation to this Privacy Notice.

(If you are located outside the UK, you may still contact our DPL with any privacy-related enquiries.)

If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, or you wish to raise a concern, please contact the DPL by email at: DPL@winnerspeople.com 

We aim to reply to any queries within five working days.

Alternatively, you can write to us by post:

N. Wilson,

DPL, Winner People

PO Box 640

MANCHESTER

M45 0JX