Privacy policy

I. General provisions

1. The Privacy Policy defines how the Users’ personal data necessary to provide services electronically via the https://bin-to-win.com/(hereinafter referred to as the Website) are collected, processed and stored
2. The Website collects only personal data necessary for the provision and development of the services offered therein.
3. Personal data collected through the Website are processed in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations 2003 (PECR), together with any successor UK data protection legislation (together, “UK data protection law”).

II. Data Controller

The controller of personal data collected through the Website is ONESTEP FINANCIAL LTD, a company registered in England and Wales (company number 14137787, VAT registration number GB425122338), whose registered office is at Ealing Cross, 1st Floor, 85 Uxbridge Road, London, United Kingdom, W5 5TH, registered with the UK Information Commissioner’s Office under registration number CSN3554303, e-mail address: contact@bin-to-win.com (hereinafter: Administrator).

III. Purpose of collecting personal data

1. Personal data is used for the purpose of:
   • registration in the application and verification of the User’s identity,
   • enable logging in to the Website,
   • performance of the contract for services and e-services,
   • communication with the User (livechat, contact form, etc.)
   • processing and verifying voucher and prize redemptions,
   • contacting Users by telephone or SMS to seek feedback about the Festival or the Bin-to-Win campaign, where the User has not opted out,
   • personalization of the Website for Users,
   • reporting campaign statistics to our funders, including Innovate UK, in connection with our grant funding (using aggregated or anonymised data wherever possible),
   • analytical and statistical activities,
   • establishing, pursuing or defending against claims.
2. Providing data is voluntary, but necessary to conclude a contract or use other functionalities of the Website.
3. Messages needed to provide the service (for example, verification codes and confirmations of a deposit refund or voucher redemption) are sent as part of performing our contract with the User and do not require separate marketing consent. Marketing messages, and calls or texts seeking feedback about the Festival, are sent only with the User’s consent or under our legitimate interests in improving the campaign, and the User may opt out at any time by contacting contact@bin-to-win.com.

IV. Type of personal data processed

The Administrator may process the following categories of the User’s personal data: name, e-mail address, telephone number, details of any Facebook or Google account used to register, cup scan and voucher/prize redemption records, and technical/usage data collected via cookies (see Section VIII).

Where a User is aged 13-17, we only collect the personal data described in this Section with the consent of their parent or guardian, in accordance with the Application’s Terms and Conditions.

V. Period of personal data processing

Users’ personal data will be processed for the period of:

• when the basis for data processing is the performance of a contract (for example, registering for the Bin-to-Win campaign or redeeming a voucher) – for the duration of the Festival campaign and for up to 3 months afterwards for verification and complaint-handling purposes,
• when the basis for data processing is consent (for example, marketing communications, or feedback calls or texts) – until the User withdraws consent,

In all cases, we may keep data for longer where necessary to establish, exercise or defend legal claims, generally up to 6 years in line with the Limitation Act 1980.

VI. Sharing of personal data

1. Users’ personal data may be shared with: companies related to the Administrator; our subcontractors and service providers, for example payment and payout providers, app hosting and IT providers, and law firms; the operators of bars taking part in the campaign, to the extent needed to verify deposit and voucher redemptions; and our funders, including Innovate UK, for grant monitoring and reporting purposes (using aggregated or anonymised data wherever possible).
2. Some of our service providers are located outside the United Kingdom, including in the European Economic Area (EEA) and elsewhere. Transfers to the EEA are protected by the UK’s data protection adequacy regulations; other transfers are protected by a UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism recognised under UK data protection law.

VII. Users’ rights

1. The Website User has the right to: access the content of their personal data, rectify them, delete them, limit processing, transfer, object to the processing, withdraw consent at any time (which does not affect the lawfulness of the processing carried out on the basis of consent before its withdrawal).
2. A notification about the User’s withdrawal from the rights under the above-mentioned rights should be sent to the contact@bin-to-win.com address.
3. The Administrator fulfills or refuses to fulfill the request immediately – within a maximum of one month from its receipt.
4. The User has the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) if they believe that the processing violates their rights and freedoms (UK GDPR).
5. Users may also complain directly to the Administrator at contact@bin-to-win.com. We will acknowledge complaints within 30 days and respond without undue delay.

VIII. Cookies

1. The website collects information using cookies – session, permanent and third-party cookies.
2. Strictly necessary cookies, needed to make the Website and Application work, are used without requiring consent. Other cookies (for example, analytics or marketing cookies) are used only with the User’s consent, given through the cookie banner shown on first visiting the Website, except where an exemption applies under PECR. [The specific cookies used, their purposes and their duration are to be confirmed by the technical team and listed in the cookie banner.]
3. Collecting cookies supports the correct provision of services on the Website and serves statistical purposes.
4. The user can determine the scope of access of cookies to their device in the browser settings.

IX. Automated Decision-Making and Profiling

1. Users’ data cannot be processed in an automated manner so that any decisions could be made against them as a result.
2. Users’ data may be profiled in order to adjust the content and personalize the offer after they have given their consent.

X. Final provisions

1. The Administrator has the right to make changes to the Privacy Policy, while the Users’ rights will not be limited.
2. Information about the changes will appear in the form of a message available on the Website.
3. In matters not covered by this Privacy Policy, UK data protection law and the laws of England and Wales shall apply.