Entrant Privacy Notice

Last updated: 8 July 2026

FrameLogic Limited, "FullRev" Skill Prize Competitions

Version: 1.0, 8 July 2026. This notice applies to each individual competition, read together with the Competition Schedule and the Competition Terms and Conditions for that competition.

1. About this notice

This Privacy Notice explains how FrameLogic Limited ("we", "us", "our", the "Promoter") collects, uses, shares and protects the personal data of entrants ("you", "your") when you enter a paid-entry skill prize competition that we run under our "FullRev" brand. It is specific to competition entry. Where you also use the FullRev app or website for other purposes, our general privacy policy at https://fullrev.app/privacy applies in addition to this notice. If there is any conflict between this notice and the general privacy policy in relation to competition entry, this notice prevails.

We are committed to processing your personal data lawfully, fairly and transparently in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where relevant to electronic messages and device data, the Privacy and Electronic Communications Regulations 2003 (PECR).

Our competitions are genuine competitions of skill. Some of the ways we process your data, and some of the periods for which we keep it, exist specifically so that we can demonstrate that fact and can rely on the reasonable-belief defence under the Gambling Act 2005. This is explained where relevant below.

This notice does not reduce or replace any rights you have under data protection law. Nothing in it, or in the Competition Terms and Conditions, requires you to waive any right you have under the UK GDPR or the Data Protection Act 2018.

2. Who we are (data controller) and how to contact us

The data controller responsible for your personal data is:

Controller: FrameLogic Limited, a private limited company registered in England and Wales.
Company number: 17193146.
Registered address: 58 Rochester Avenue, Feltham, England, TW13 4EJ.
Trading name: FullRev.
ICO registration number: ZC180026.
Data protection contact: hello@fullrev.app, or by post marked "Data Protection" to the registered address above.

If you have any question about this notice or about how we handle your personal data, please contact us using the details above. We have not appointed a statutory Data Protection Officer, because we are not required to do so, but the contact above is responsible for data protection matters and will handle your query. If we are required to appoint a Data Protection Officer in future, we will update this notice with their contact details.

Where a payment processor, verification provider or other third party acts as a separate controller of your data (rather than as our processor), that party is responsible for its own processing under its own privacy notice. Section 5 identifies where this is the case, and you should read that party's own privacy notice for details of how it uses your data and the rights you have against it.

3. The personal data we collect

When you enter a competition we collect and process the following categories of personal data:

Identity data: your name, your username or account identifier, and where relevant your date of birth or confirmation that you are aged 18 or over.
Contact data: your email address, and, if you win or if we need to deliver a prize, your postal address and telephone number.
Entry and answer data: the answer or answers you submit to the skill question or puzzle, the server-recorded time and date of your entry, the number of entries you have made, and any tie-break answer or other material you submit as part of your entry.
Payment data: a payment reference, transaction identifier, the amount paid, the currency, the outcome of the payment (including whether it settled, failed, was refunded or was charged back), and the partial card or account details returned to us by our payment processor. We do not store your full card number or security code; these are handled by our payment processor.
Eligibility and verification data: information we use to check that you are eligible and that your entry is genuine, which may include your date of birth or age confirmation, indicators of your country or region of residence, and, for a winner before a prize is released, identity-verification information (which may include a copy of a government-issued identity document and, where lawfully required, sanctions, anti-money-laundering or fraud screening results).
Integrity and anti-fraud data: information we use to detect and prevent fraud, chargebacks, multiple or duplicate entries, automated or bot entries, collusion, answer-sharing, use of VPNs or proxies to disguise location, and other rule breaches. This may include your IP address, approximate geolocation, device, browser or account identifiers, payment-instrument fingerprints, links between accounts, and records of previous entries and previous rule breaches.
Correspondence and support data: the content of messages, emails or other correspondence between you and us relating to the competition, including any complaint, query, dispute over marking or eligibility, refund request or chargeback.
Marketing preferences: your consent to, or objection to, receiving optional marketing from us.
Publicity and user-generated content: where a competition involves a creative or tie-break submission, or where a winner participates in publicity, the content you submit and any winner-announcement details or images you consent to us using.

Where you provide personal data about any other person (for example a nominee, a joint prize recipient or someone whose details appear in content you submit), you confirm that you have their authority to do so and that you have made them aware of this notice.

We collect most of this data directly from you when you enter. We also receive some payment and settlement data from our payment processor, some verification data from age, identity, sanctions or fraud-prevention providers, and some integrity data from the technical systems used to run the competition.

Providing the identity, contact, entry, answer, eligibility and payment data described above is necessary to enter the competition and, if you win, to receive the prize. It is a requirement for entering into and performing the contract between you and us. If you do not provide it, we cannot accept or process your entry, or cannot release a prize to you.

We do not knowingly collect the personal data of anyone under the age of 18. Our competitions are open only to entrants aged 18 or over, and we may carry out age-verification checks. If we become aware that a person under 18 has entered or provided data, we will void the entry, refund any fee taken to the person who paid it in a way that retains no benefit, and delete the data except where we must keep a minimal record to evidence that we handled the matter correctly.

4. How and why we use your data, and our lawful bases

We use your personal data only where the law allows us to. The table below sets out each purpose and the lawful basis under Article 6 of the UK GDPR on which we rely.

Purpose	Personal data used	Lawful basis
To accept your entry, take payment of the entry fee, confirm your payment has settled, and administer your participation in accordance with the Competition Terms and Conditions	Identity, contact, entry and answer, payment data	Performance of a contract with you (Article 6(1)(b)). Entering the competition forms a contract between you and us on the published terms.
To assess and mark entries, apply the skill filter as the first stage of allocation, run any tie-break, identify qualifying (correct) entries, conduct the random draw among qualifying entries, and select the winner	Identity, entry and answer, integrity data	Performance of a contract (Article 6(1)(b)); and legitimate interests (Article 6(1)(f)) in running a fair and correctly judged competition.
To verify a winner's eligibility and identity before releasing a prize, including age, residence, identity-document checks and, where lawfully required, sanctions, anti-money-laundering or fraud screening	Identity, contact, eligibility and verification data	Performance of a contract (Article 6(1)(b)); compliance with a legal obligation (Article 6(1)(c)) where screening is legally required; and legitimate interests (Article 6(1)(f)) in awarding prizes only to eligible, verified winners.
To contact you about your entry, notify you if you win, arrange delivery, registration or transfer of the prize, handle refunds and chargebacks, and respond to your correspondence	Identity, contact, payment, correspondence data	Performance of a contract (Article 6(1)(b)).
To run and protect a fair competition, including verifying eligibility, preventing and detecting fraud, chargeback abuse, duplicate, multiple, automated, collusive or circumventing entries and other rule breaches, and enforcing the Competition Terms and Conditions	Identity, contact, entry, eligibility, integrity data	Legitimate interests (Article 6(1)(f)) in protecting the integrity of the competition, preventing fraud and abuse, and maintaining the trust of entrants.
To keep records that evidence how the competition was designed, marked and run, including the difficulty rationale for the skill element, the marking basis, the eligible-entry pool, the draw method and the adjudicator's decisions, so that we can demonstrate that it was a genuine competition of skill and not an unlawful lottery, and can rely on the reasonable-belief defence under the Gambling Act 2005	Entry and answer, integrity, payment, correspondence data	Legitimate interests (Article 6(1)(f)) in defending our legal position and demonstrating regulatory compliance; and compliance with a legal obligation (Article 6(1)(c)) where record-keeping is legally required.
To comply with our legal, regulatory, tax, accounting and advertising-code obligations, and to establish, exercise or defend legal claims	Identity, contact, payment, entry, correspondence data	Compliance with a legal obligation (Article 6(1)(c)); and, where not strictly required by law, legitimate interests (Article 6(1)(f)) in protecting and enforcing our legal rights.
To publish the result so that entrants can verify a genuine prize was awarded (for example the winner's first name or surname and county), and to make winner information available to the Advertising Standards Authority on request	Limited identity and location data of the winner only	Legitimate interests (Article 6(1)(f)) in transparent, verifiable competitions and compliance with the advertising codes, and, where we rely on it, your consent (Article 6(1)(a)) obtained at entry.
To carry out, with your separate consent, any wider winner publicity (such as photographs, interviews or use of your likeness in marketing)	Publicity and user-generated content, identity data	Consent (Article 6(1)(a)), given separately and withdrawable at any time.
To send you optional marketing about future competitions, offers or FullRev services by electronic means	Identity, contact, marketing preference data	Consent (Article 6(1)(a)), which you give separately and can withdraw at any time, and which also satisfies PECR for electronic marketing.

Special category and criminal-offence data. We do not seek to collect special category data (such as data revealing health, race or biometric identity). If an identity document you provide for winner verification incidentally contains such information, we process it only to the extent necessary to verify identity and eligibility, relying on the substantial-public-interest and legal-claims conditions in Schedule 1 to the Data Protection Act 2018 alongside Article 9 of the UK GDPR, and we minimise and delete it as soon as verification is complete. Where fraud, sanctions or anti-money-laundering screening involves data about actual or alleged offences, we process it under the fraud-prevention, legal-obligation and legal-claims conditions in Schedule 1 to the Data Protection Act 2018, and we maintain the appropriate-policy document that those conditions require.

Our legitimate interests. Where we rely on legitimate interests, those interests are running a fair, lawful and well-evidenced competition, protecting it and our entrants from fraud, chargeback abuse and manipulation, being able to demonstrate and defend our compliance with the law, and promoting our competitions and services. We have carried out a balancing assessment (a legitimate-interests assessment) and only rely on this basis where our interests are not overridden by your interests, rights and freedoms. You can ask us for more information about this balancing assessment using the contact details in section 2.

Marketing is always separate and optional. We will only send you electronic marketing where you have given specific, opt-in consent. Entering a competition does not sign you up to marketing, and marketing consent is never a condition of entry or of any chance of winning. You can withdraw consent at any time by using the unsubscribe link in any marketing message or by contacting us using the details in section 2. Withdrawing marketing consent does not affect your entry or your chance of winning, and does not affect the lawfulness of any processing carried out before you withdrew consent.

Cookies and similar technologies. Where we use cookies or similar technologies on the FullRev app or website in connection with a competition, including any used for the integrity and anti-fraud purposes described above, these are governed by our cookie policy at https://fullrev.app/cookies, and, where they are not strictly necessary, we set them only with your consent as required by PECR.

5. Who we share your data with

We do not sell your personal data. We share it only as set out below, and only to the extent necessary for the purposes described in this notice. The specific providers used for a given competition, where they differ from the list below, are identified at available from us on request using the contact details above.

Recipient (type)	Purpose of sharing	Role
Payment processor: the payment processor identified in the applicable Competition Schedule	Taking the entry fee, confirming settlement, issuing refunds, and handling chargebacks	Processes card or account details under its own terms; acts as a separate controller for those details and as our processor for the transaction records we hold
Hosting and infrastructure provider: our cloud hosting and database provider	Hosting the competition systems, entry records and databases	Processor
Email and communications provider: our email delivery provider	Sending entry confirmations, winner notifications and, separately, marketing where consented	Processor
Age, identity and eligibility verification provider: our verification provider, where one is used	Confirming age, residence and, for a winner, identity before a prize is released	Processor, or separate controller for its own screening records
Fraud, sanctions and anti-money-laundering screening provider: our identity and eligibility screening provider, where one is used	Detecting fraud and screening a winner where lawfully required	Processor, or separate controller for its own screening records
Independent draw adjudicator, judge or verifier	Conducting or independently verifying the marking, tie-break and random draw, and evidencing the result	Processor or independent professional, as applicable
Prize-delivery, registration or transfer partner: the vehicle supplier, logistics, insurer or vehicle-registration service for the prize, where the prize is a vehicle	Delivering, registering, insuring or transferring the prize to the winner	Separate controller or processor depending on the service
Professional advisers: legal advisers, accountants, auditors and insurers	Running the competition, taking advice, prize-indemnity insurance, and establishing, exercising or defending legal claims	Separate controllers in their professional capacity
Regulators, authorities and legal disclosure: the Gambling Commission, the Advertising Standards Authority, HM Revenue and Customs, the Information Commissioner's Office, the police, courts and other authorities	Complying with a legal obligation, responding to a lawful request, or protecting our rights	Recipients in their own right
Corporate transactions: a prospective or actual buyer of our business or assets, and its advisers	A reorganisation, sale or transfer of our business, subject to confidentiality protections	Recipient / prospective controller

We do not share your personal data with any recipient except as described in this notice or as you have otherwise consented to or as we are required or permitted by law to do.

Where third parties act as our processors, they may only use your data on our documented instructions, must keep it secure under a written contract that meets Article 28 of the UK GDPR, and must not engage a sub-processor without our authorisation and appropriate safeguards. Where a third party acts as a separate controller, it is responsible for its own processing under its own privacy notice, and we are not responsible for how it uses your data as a separate controller, though we take reasonable steps to share it only with reputable providers.

6. Publication of the winner

To show that a genuine prize was awarded, and as required by the advertising rules that apply to prize promotions (including the CAP Code), we will make available limited details of the winner, for example the winner's first name or surname and county. We will obtain the winner's consent to this at entry, and we publish only the minimum necessary. If you win and you object to publication of your full details, you may ask us to provide the information in an alternative form, and you may ask us to provide details only to the Advertising Standards Authority on request rather than by public announcement. We may still be required to make some verifiable announcement, or to provide winner information to the ASA on request, in order to comply with the advertising codes, and we will discuss this with you and seek to agree a form of announcement that meets those obligations while limiting what is published about you. Any wider publicity (photographs, interviews or use of your likeness in our marketing) is separate, is done only with your specific consent, and can be declined or later withdrawn without affecting your prize.

7. International transfers

We aim to store and process your personal data within the United Kingdom. Some of our service providers, such as our payment processor, hosting provider, verification providers or IT providers, may process personal data outside the UK.

Where personal data is transferred outside the UK, we ensure that a similar level of protection applies by relying on one of the following safeguards:

the country or territory has been granted "adequacy" status by the UK Government (UK adequacy regulations); or
we use the International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission's Standard Contractual Clauses, approved for use in the UK, together with any additional safeguards a transfer-risk assessment identifies as necessary; or
another lawful transfer mechanism permitted under the UK GDPR applies.

You can ask us for a copy of the relevant safeguard, or details of where your data is transferred, using the contact details in section 2. Specific transfer details for each competition, where relevant, are set out at available from us on request.

8. How long we keep your data

We keep your personal data only for as long as we need it for the purposes set out in this notice, and then delete or anonymise it. Our retention periods are:

Entry, answer, marking, eligible-pool, draw and integrity records: kept for the duration of the competition and then retained for 6 years after the competition closes or is otherwise concluded. We keep these records for at least this long so that we can evidence how the competition was designed, marked, run and won, demonstrate that it was a genuine competition of skill and not an unlawful lottery, support the reasonable-belief defence under sections 258 to 260 of the Gambling Act 2005, respond to any challenge by a regulator or entrant, and establish, exercise or defend legal claims. This is why we may be unable to fully erase these records on request while that period runs (see section 10).
Winner records and prize-award records: kept for 6 years after the prize is awarded, to evidence the award and to meet tax and accounting obligations.
Financial, payment, refund and chargeback records: kept for at least 6 years to meet HM Revenue and Customs and accounting requirements, and longer where a chargeback, dispute or claim remains open.
Winner identity-verification and screening records: kept only for as long as necessary to evidence that the required checks were carried out, which we expect to be no longer than 6 years after the prize is awarded, and then securely deleted; copies of identity documents are deleted as soon as verification is complete and evidenced, subject to any longer period required by law.
Correspondence, complaints and dispute records: kept for 2 years after the matter is resolved, or longer where needed to defend a claim.
Fraud, rule-breach and exclusion records: kept for 6 years so that we can identify and exclude repeat offenders and protect future competitions.
Marketing consent and preference data: kept until you withdraw consent or object, and then a suppression record (the minimum needed to ensure we do not contact you again, and evidence that you opted out) is retained for as long as necessary for that purpose.

Where any period above is required by law to be longer, the longer legal period applies. Where we say "at least" a period, we will not keep the data beyond what is necessary for the purposes described, and in any event no longer than 7 years after the relevant period begins unless a specific legal obligation, or an open dispute, claim or investigation, requires us to keep it longer. At the end of the applicable period we securely delete or irreversibly anonymise your data.

9. How we protect your data and handle data breaches

We use appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful access, loss, destruction, misuse or alteration. These include access controls and role-based access, encryption of data in transit and, where appropriate, at rest, restricting access to those who need it, secure handling and prompt deletion of identity documents, network and application security controls, and written contracts with our processors. We keep these measures under review. No system can be guaranteed to be completely secure, and while we take appropriate steps to protect your data we cannot warrant the absolute security of information transmitted to us over the internet.

Data breaches. We maintain an internal breach-response procedure. If a personal data breach occurs, we will assess it without undue delay. Where the breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office without undue delay and, where feasible, not later than 72 hours after becoming aware of it. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify affected entrants without undue delay and tell you what has happened, the likely consequences and the steps we are taking. We keep a record of all personal data breaches, whether or not they are notifiable.

If a security incident affects the running of a live competition, we may suspend the competition, and, where necessary and as provided in the Competition Terms and Conditions, void it and refund entry fees.

10. Your rights

Under the UK GDPR, you have the following rights in relation to your personal data. Some of these rights apply only in certain circumstances, and where a right does not apply to particular data we will explain why.

The right to be informed about how we use your data, as set out in this notice.
The right of access to a copy of the personal data we hold about you.
The right to rectification of inaccurate or incomplete data.
The right to erasure of your data in certain circumstances. We may be unable to erase entry, answer, payment, marking, eligible-pool, draw, integrity or fraud records while a competition is ongoing, or during the retention periods in section 8, where we need them to evidence the fairness and lawfulness of the competition, to support the reasonable-belief defence under the Gambling Act 2005, to comply with a legal or accounting obligation, or to establish, exercise or defend legal claims. We will erase what we can and explain what we must keep and why.
The right to restrict processing in certain circumstances.
The right to data portability, allowing you to obtain and reuse data you provided to us, where we process it by automated means on the basis of contract or consent.
The right to object to processing based on our legitimate interests, and an absolute right to object to direct marketing at any time. If you object to integrity or fraud-prevention processing, we may be unable to accept or continue your entry, because that processing is necessary to run a fair and lawful competition; where we can demonstrate compelling legitimate grounds that override your interests, or that we need the data to establish, exercise or defend legal claims, we may continue to process it.
The right to withdraw consent at any time where we rely on consent (including for marketing and for wider winner publicity), without affecting the lawfulness of processing before withdrawal.

These rights are free to exercise, subject to the limited exceptions below.

Automated decision-making and profiling. Running a competition at scale involves some automated steps. Entries may be marked automatically against the published correct answer, the random draw among qualifying entries is carried out by an automated method, and we use automated checks (for example to detect duplicate, automated, collusive or fraudulent entries and to flag ineligible entries). These steps determine whether an entry qualifies and whether it is selected, which can have a significant effect on you.

Automatic marking simply compares your answer to the pre-published correct answer, and you can ask us to review the marking of your own entry through the dispute process in the Competition Terms and Conditions, where a person will consider it.
For a high-value prize, the final allocation is safeguarded by human involvement: an independent adjudicator judges any tie-break and confirms the result, and the winner is verified by a person before any prize is released.
Where an automated integrity or fraud check flags your entry, you can contact us to ask for the decision to be reviewed by a person, to express your point of view, and to contest the outcome. We will not disqualify you on the basis of a solely automated decision that produces legal or similarly significant effects, without meaningful human review, except where that decision is authorised by law or is necessary for entering into or performing our contract with you and is accompanied by the safeguards the law requires, including your right to obtain human review, to express your view and to contest the decision.

We do not use your competition data for automated decision-making producing legal or similarly significant effects on you beyond what is described here, and we do not carry out solely automated decision-making without a lawful basis and appropriate safeguards.

How to exercise your rights. To exercise any of these rights, contact us using the details in section 2. We will respond within one month, which we may extend by up to two further months for complex or numerous requests, in which case we will tell you within the first month and explain why. We do not usually charge a fee, but we may charge a reasonable fee based on our administrative costs, or refuse a request, where the request is manifestly unfounded or excessive, and if we refuse a request we will tell you why and inform you of your right to complain to the ICO. We may need to verify your identity before acting on your request, and where we reasonably need more information to do so or to locate your data, the response period does not begin until we have received it.

11. Your right to complain to the ICO

If you are unhappy with how we have handled your personal data, please contact us first using the details in section 2 so that we can try to resolve it. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk(https://ico.org.uk)

Complaining to the ICO does not affect any other legal rights or remedies you may have.

12. Changes to this notice

We may update this notice from time to time. The version and date at the top show when it was last changed. Where changes are significant, we will take reasonable steps to bring them to your attention, for example by notice on the FullRev app or website or, where appropriate, by contacting you directly. The notice that applied at the time you entered a particular competition governs the data you provided for that competition, except where we are required to apply a change to existing data to comply with the law.

This is a draft for solicitor review. It must be reviewed and approved by a specialist UK data protection and gambling or promotions solicitor, and all placeholders completed, before it is published or relied upon.