Schedule a Consultation

Privacy policy

Privacy policy

Effective date: 30.09.2026

This Privacy Policy governs the collection, receipt, use, storage, disclosure, transfer, protection, and other processing of Personal Data by ACompany in connection with the provision of the Company’s Services and the operation of the Company’s website.

This Privacy Policy establishes the principles and conditions applicable to the processing of Personal Data by the Company and describes, in particular, the categories of Personal Data that may be processed by the Company, the purposes and legal grounds for such processing, the manner in which Personal Data may be collected, used, stored, disclosed, or transferred, the applicable retention and security measures, as well as the rights of individuals whose Personal Data is processed by the Company.

For the purposes of this Privacy Policy, references to “we”, “our”, “us”, or other equivalent terms shall mean the Company.

References to “you”, “your”, or other equivalent terms shall mean the User who accesses or uses the Company’s Services or otherwise interacts with the Company in connection with the provision of such Services.

The terms used in this Privacy Policy shall have the meanings assigned to them herein. References to a person in the singular shall, where the context so requires, include the plural, and references to any gender shall include all genders.

This Privacy Policy applies to the processing of Personal Data carried out by the Company in connection with the provision of the Services and the User’s interaction with the Company.

1. DEFINITIONS

In this Privacy Policy, the following terms shall have the meanings set out below:

  1. Personal Data means any information relating to an identified or identifiable natural person, including, without limitation, a person’s name, surname, telephone number, email address, IP address, online identifiers, and other information that directly or indirectly enables such person to be identified.
  2. Services means the services and activities provided or carried out by the Company for Users, including marketing and advertising services, promotion of products, services and projects, development and implementation of projects, publication, placement and promotion of applications on third-party platforms, as well as other related services and activities provided or carried out by the Company.
  3. Company’s website (the “Site”) means the website and all web pages operated by the Company and available at https://acrosstheaward.com/.
  4. ACROSS THE AWARD LLP (the “Company”) means ACROSS THE AWARD LLP, company number OC445222, with its registered office at 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom, which provides the Services to Users.
  5. User means an individual or legal entity that accesses or uses the Site, receives the Services, communicates with the Company in connection with the Services, or otherwise interacts with the Company.
  6. Third Party means any natural or legal person, public authority, agency, institution, organisation, or other entity other than the Company, the User, the Controller, or the Processor.
  7. Controller means a natural or legal person, public authority, agency, institution, or other body that, alone or jointly with others, determines the purposes and means of the processing of Personal Data.
  8. Processor means a natural or legal person, public authority, agency, institution, or other body that processes Personal Data on behalf of the Controller.
  9. Cookies means small text files or other pieces of data that are stored on or transmitted to a User’s device or browser when the User accesses or uses the Site and that may be used to recognise the User’s device, store preferences, collect information about the use of the Site, or perform other functions described in this Privacy Policy.
  10. User’s Consent (the “Consent”) means any freely given, specific, informed, and unambiguous indication of the User’s wishes by which the User, by a statement or by a clear affirmative action, signifies agreement to the processing of his or her Personal Data for the specified purpose or purposes.

2. GENERAL PROVISIONS

  1. The Company processes and stores Personal Data in accordance with the data protection and privacy laws applicable to the relevant processing activities, including:
    • the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, to the extent applicable to the processing of Personal Data in the United Kingdom;
    • Regulation (EU) 2016/679 (General Data Protection Regulation) (GDPR), to the extent applicable to the processing of Personal Data of individuals located in the European Union or European Economic Area;
    • applicable federal and state privacy and data protection laws of the United States, including applicable comprehensive state consumer privacy laws.
  2. The Company shall not be responsible for the processing of Personal Data by Third Parties where such Third Parties independently determine the purposes and means of such processing and are not acting on behalf of or under the control of the Company.
  3. The Company acts as a Controller where it independently determines the purposes and means of processing Personal Data in connection with the operation of the Site, provision of the Services, communication with Users, administration of its business activities, compliance with applicable legal obligations, and protection of the Company’s rights and legitimate interests.
  4. The Company may act as a Processor where it processes Personal Data on behalf of a User or another Controller in connection with the provision of the Services. In such cases, the Company processes Personal Data in accordance with the instructions of the relevant Controller and the applicable data protection requirements.

3. PERSONAL DATA

  1. In connection with the provision of the Services, operation of the Site, communication with Users and the conduct of the Company’s business activities, the Company may collect and process Personal Data received directly from Users, from the Company’s clients, business partners and other Third Parties, or generated in the course of the User’s interaction with the Company, the Services or the Site. Such Personal Data may include:
    • first name and surname;
    • email address;
    • telephone number;
    • date of birth;
    • residential, correspondence or other street address;
    • legal address;
    • other Personal Data voluntarily provided by the User or lawfully provided to the Company by a client, business partner or other Third Party in connection with the Services.
  2. The categories of Personal Data processed by the Company may vary depending on the nature of the Services, the manner in which the User interacts with the Company and the particular purpose for which the relevant Personal Data is processed.
  3. The Company does not intentionally collect or process Users’ payment card credentials or other banking authentication data as part of the ordinary operation of the Site or provision of the Services. Where banking, invoicing or other payment-related details are required in connection with a contractual relationship between the Company and a User, such details may be specified in a separate agreement, invoice or other payment document and processed to the extent necessary for the performance of the relevant contractual obligations, accounting purposes, resolution of payment-related matters or compliance with applicable legal requirements.

    Where payments are processed through a third-party payment service provider, the relevant payment information may be collected and processed directly by that provider in accordance with its own terms and privacy practices, and the Company shall process only such payment-related information as is necessary for the relevant transaction, accounting, legal or dispute-resolution purposes.

  4. The Company does not intentionally collect or process special categories of Personal Data, including Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a person’s sex life or sexual orientation.
  5. When a User accesses or uses the Site or otherwise interacts with the Company through electronic means, the Company may automatically collect and process technical, device and usage information, including:
    • the User’s IP address;
    • browser type and version;
    • Internet service provider;
    • operating system and device type;
    • language and time-zone settings;
    • screen resolution and other technical characteristics of the User’s device;
    • country or approximate geographical location derived from technical information;
    • referring and exit pages;
    • date and time of access;
    • pages viewed and the duration of visits;
    • clickstream data, scrolling activity, clicks and other information concerning the User’s interaction with the Site;
    • information concerning errors, page response times and other technical events occurring during use of the Site.

    The Company may combine automatically collected information with other Personal Data lawfully obtained by the Company where such combination is necessary for the purposes set out in this Privacy Policy.

  6. The Company may collect and receive Personal Data:
    • directly from a User, including when the User contacts the Company, submits an enquiry or other information, enters into contractual relations with the Company, receives the Services or otherwise communicates or interacts with the Company;
    • from the Company’s clients, business partners, contractors and other Third Parties where such Personal Data is lawfully provided to the Company in connection with the provision of the Services;
    • automatically through log files, Cookies, web beacons, tags, scripts and other tracking or similar technologies used in connection with the Site and the Services;
    • through advertising, marketing, analytics and other third-party platforms or services used by the Company in connection with the Services, to the extent permitted by applicable law.
  7. The Company may process Personal Data for the following purposes:
    • to provide, perform, administer and support the Services;
    • to communicate with Users, respond to enquiries, requests and other communications, and manage the Company’s relationships with Users, clients and business partners;
    • to carry out marketing, advertising, promotion, lead generation and other activities forming part of the Services;
    • to administer, maintain and secure the Site and the Company’s information systems, including troubleshooting, testing, monitoring, data analysis and prevention of unauthorised or unlawful activity;
    • to analyse the use, effectiveness and performance of the Site, the Services, advertising and marketing activities and to improve the functionality and quality thereof;
    • to personalise or adapt the User’s interaction with the Site or the Services where applicable;
    • to maintain records relating to the provision of the Services, communications, contractual relationships and the Company’s business activities;
    • to comply with applicable legal, regulatory, accounting and reporting obligations and to respond to lawful requests of courts, law enforcement authorities, regulators and other competent public authorities;
    • to establish, exercise or defend legal claims, resolve disputes, conduct investigations and protect the rights, property and legitimate interests of the Company, Users and Third Parties;
    • for other purposes directly connected with the Services or the Company’s relationship with the relevant User, provided that such processing is carried out in accordance with applicable law and this Privacy Policy.

4. DIRECT MARKETING AND TELEMARKETING

  1. The Company may use Personal Data, including telephone numbers and other contact details, for direct marketing purposes where such processing and communications are permitted by applicable law. The legal requirements applicable to such communications may vary depending on the jurisdiction in which the User is located and the method of communication used by the Company.
  2. Where the Company makes live marketing calls to Users located in the United States, the Company may contact a User who has submitted an enquiry or application to the extent permitted under applicable federal and state telemarketing laws and regulations. Any such right to contact the User shall be subject to applicable do-not-call requirements and shall cease where the User has requested that the Company no longer make such calls.
  3. The Company shall not make marketing calls using prerecorded or artificial voice messages, automated calling technologies, or other methods for which prior consent is required by applicable law unless the Company has obtained the User’s prior consent in the form required by such law. Where prior written consent is required, such consent shall be obtained separately and shall identify the relevant method of communication and the telephone number to which such communications may be made.
  4. Where the Company carries out telephone marketing in the United Kingdom, the Company shall comply with the applicable requirements governing direct marketing communications, including requirements relating to the Telephone Preference Service, the Corporate Telephone Preference Service, previous objections to marketing communications and, where applicable, the User’s Consent. The Company shall obtain specific Consent before making automated marketing calls where such Consent is required by applicable law.
  5. A User may withdraw Consent or object to receiving direct marketing communications from the Company at any time by using the contact details specified in this Privacy Policy or by following any other opt-out mechanism provided by the Company.

5. TRANSFER OF PERSONAL DATA

  1. The Company may disclose or transfer Personal Data to Third Parties only where such disclosure or transfer is necessary for the provision of the Services, the conduct of the Company’s business activities, compliance with applicable legal obligations, or the exercise and protection of the Company’s rights and legitimate interests, and only to the extent permitted by applicable data protection and privacy laws.
  2. The Company may disclose or transfer Personal Data to the following categories of recipients:
    • service providers, contractors and other entities engaged by the Company to provide hosting, data storage, data processing, information technology, technical support, communications, analytics, accounting, legal, administrative or other services necessary for the operation of the Site, provision of the Services or conduct of the Company’s business activities;
    • clients, business partners and other Third Parties where the transfer of Personal Data is necessary for the provision of the Services requested by or relating to the relevant User, including where the relevant Personal Data is processed in connection with marketing, advertising, promotion or lead generation activities, provided that such transfer is permitted by applicable law;
    • Third Parties where the User has expressly requested, authorised or consented to the disclosure or transfer of Personal Data, including where the User has agreed to receive information, offers or communications relating to products or services provided by such Third Parties;
    • professional advisers, including legal advisers, accountants, auditors, tax advisers and other professional consultants, where access to Personal Data is reasonably necessary for the provision of their professional services to the Company;
    • courts, law enforcement authorities, regulatory authorities, governmental bodies and other competent public authorities where the Company is required or permitted to disclose Personal Data pursuant to applicable law, a court or administrative order, a lawful request of a competent authority, or where such disclosure is reasonably necessary to establish, exercise or defend legal claims, investigate suspected fraud or unlawful activity, or protect the rights, property or safety of the Company, Users or Third Parties;
    • a purchaser, investor, successor, assignee or other relevant Third Party in connection with an actual or proposed merger, acquisition, financing, corporate reorganisation, sale or transfer of all or part of the Company’s business or assets, or any other similar corporate transaction, provided that the relevant Personal Data is processed in accordance with applicable data protection requirements.
  3. Where a Third Party processes Personal Data on behalf of the Company as a Processor, the Company shall require such Processor to process Personal Data only for the purposes for which it has been disclosed, in accordance with the Company’s documented instructions and subject to appropriate contractual obligations concerning confidentiality, security and protection of Personal Data.
  4. The Company shall not disclose Personal Data to Third Parties for their own direct marketing or promotional purposes unless the User has provided the Consent required for such disclosure or the disclosure is otherwise expressly permitted by applicable law. Any Consent required for such purposes shall be obtained separately from the User and may be withdrawn in accordance with this Privacy Policy and applicable law.
  5. Due to the international nature of the Company’s activities and the provision of the Services in different jurisdictions, Personal Data may be transferred to, accessed from or otherwise processed in countries other than the country in which the User is located, including countries outside the United Kingdom or the European Economic Area.

    Where such transfer is subject to restrictions under applicable data protection law, the Company shall implement an appropriate lawful transfer mechanism, which may include:

    • transfer to a country, territory or recipient recognised as providing an adequate level of protection for Personal Data;
    • the use of the European Commission’s Standard Contractual Clauses, where the GDPR applies;
    • the use of the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses, where the UK GDPR applies; or
    • another transfer mechanism permitted under applicable data protection law.

6. USER CONSENT

  1. Where the processing of Personal Data is based on Consent, the Company shall obtain the User’s voluntary, specific, informed and unambiguous Consent before carrying out the relevant processing. Depending on the nature of the processing and the method by which the User interacts with the Company, Consent may be provided by one or more of the following actions:
    • checking the relevant checkbox or using another equivalent affirmative control made available through the Site where Consent is required;
    • subscribing to newsletters or other marketing communications through the relevant subscription mechanism;
    • expressly consenting to receive marketing communications by telephone, SMS, email or other electronic means where such Consent is required by applicable law;
    • confirming Consent through an electronic form, email confirmation or another technical method made available by the Company for the relevant processing activity.
  2. The Company shall present a request for Consent separately from other information where required by applicable law and shall provide the User with sufficient information to understand the purposes of the relevant processing, the categories of Personal Data concerned and, where applicable, the categories of recipients to whom such Personal Data may be disclosed.
  3. Where Consent is required for direct marketing, telemarketing, automated calls, prerecorded messages, SMS communications or any other form of marketing communication subject to specific consent requirements under applicable law, the Company shall obtain such Consent separately and in the form required by the laws applicable to the relevant communication and the jurisdiction in which the User is located.
  4. The Company may request that the User renew or reconfirm Consent where required by applicable law, where the purposes or scope of the relevant processing materially change, or where the Company reasonably determines that the existing Consent no longer adequately covers the intended processing activity.
  5. The User may withdraw Consent at any time by using the withdrawal mechanism made available by the Company, including an unsubscribe or opt-out mechanism contained in the relevant communication, or by contacting the Company using the contact details specified in this Privacy Policy. Withdrawal of Consent shall not affect the lawfulness of processing carried out on the basis of Consent before its withdrawal.
  6. Where the Company updates this Privacy Policy, it may notify Users through the Site, by email or by another appropriate means. Continued use of the Site or the Services following such notification may constitute acknowledgment of the updated Privacy Policy but shall not, by itself, constitute Consent to any processing activity for which Consent is required under applicable law. Where a new or renewed Consent is required, the Company shall obtain such Consent through a separate affirmative action, including a checkbox, consent form or other equivalent mechanism.

7. PERSONAL DATA STORAGE AND PROTECTION

  1. The Company uses appropriate technical and organisational measures to protect Personal Data, ensure its confidentiality, and prevent loss, unauthorised access, unlawful use, disclosure, alteration, deletion or destruction.
  2. The Company protects Personal Data against:
    • loss;
    • unauthorised access or use;
    • unlawful transfer or disclosure;
    • alteration;
    • deletion; and
    • destruction.
  3. The Company may use, in particular, the following measures, including those consistent with Article 32 of the UK GDPR and, where applicable, Article 32 of the GDPR:
    • pseudonymisation and, where appropriate, encryption of Personal Data;
    • measures to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services;
    • regular testing, assessment and evaluation of the effectiveness of technical and organisational security measures.
  4. Where the User exercises the right to erasure under applicable law, including Article 17 GDPR, where applicable, the Company will delete the relevant Personal Data unless retention is required or permitted by law, including for legal compliance, security, fraud prevention, dispute resolution, or the establishment, exercise or defence of legal claims.
  5. The Company may retain Personal Data for up to 3 (three) years after termination of the relationship with the User, to the extent necessary:
    • to comply with applicable legal obligations;
    • to ensure security and prevent fraud and abuse;
    • to resolve disputes;
    • to establish, exercise or defend legal claims;
    • to maintain business records and internal accounting; and
    • to create aggregated and/or anonymised statistics, where applicable.

8. GROUNDS FOR PERSONAL DATA PROCESSING

  1. The Company processes Personal Data only where there is a lawful basis for such processing under the UK GDPR and, where applicable, the GDPR. Depending on the purpose and circumstances of the processing, the Company may rely on one or more of the following legal grounds:
    • Consent — where the User has given Consent to the processing of Personal Data for one or more specific purposes;
    • Performance of a contract — where the processing is necessary for the performance of a contract to which the User is a party or in order to take steps at the User’s request prior to entering into a contract;
    • Compliance with a legal obligation — where the processing is necessary for the Company to comply with an obligation imposed by applicable law;
    • Legitimate interests — where the processing is necessary for the legitimate interests pursued by the Company or a Third Party, provided that such interests are not overridden by the interests, rights or freedoms of the User requiring the protection of Personal Data. Such legitimate interests may include the operation and administration of the Company’s business, provision and improvement of the Services, protection and security of the Site and the Services, prevention of fraud and misuse, management of business relationships, and the establishment, exercise or defence of legal claims.
  2. The legal ground applicable to a particular processing activity shall be determined having regard to the purpose for which the Personal Data is processed, the nature of the relationship between the Company and the User, and the requirements of applicable data protection and privacy laws.
  3. Where the processing of Personal Data is necessary for the performance of a contract, compliance with a legal obligation, or the pursuit of legitimate interests in accordance with applicable law, the Company may continue to process the relevant Personal Data notwithstanding the withdrawal of Consent, to the extent that such processing does not rely on Consent as its legal ground.

9. WITHDRAWAL OF CONSENT

  1. Where the processing of Personal Data is based on Consent, the User may withdraw such Consent at any time by sending a request to the following email address: admin@acrosstheaward.com.
  2. Upon receipt of the User’s request to withdraw Consent, the Company shall cease, as soon as reasonably practicable and without undue delay, any processing of Personal Data that is carried out solely on the basis of the withdrawn Consent.
  3. Withdrawal of Consent shall not affect the lawfulness of any processing carried out on the basis of Consent before its withdrawal.
  4. Withdrawal of Consent shall not require the Company to cease processing or delete Personal Data where such Personal Data is processed or retained on another lawful basis, including where processing or retention is necessary to comply with applicable legal obligations, perform contractual obligations, prevent fraud or unlawful activity, resolve disputes, or establish, exercise or defend legal claims.
  5. Where the withdrawn Consent relates to direct marketing or other optional communications, the Company shall cease the relevant communications as soon as reasonably practicable following receipt of the withdrawal request.

10. USER RIGHTS (UK AND EEA)

  1. This section applies to Users whose Personal Data is processed subject to the UK GDPR or, where applicable, Regulation (EU) 2016/679 (GDPR). The Company shall facilitate the exercise of the rights granted to Users under the applicable data protection legislation and shall process Personal Data in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.
  2. Subject to the conditions, limitations and exceptions established by applicable law, the User may exercise the following rights in relation to their Personal Data:
    • Right of access. The User has the right to obtain confirmation as to whether the Company processes Personal Data relating to them and, where such processing takes place, to obtain access to such Personal Data and the information required by Article 15 of the UK GDPR or, where applicable, Article 15 of the GDPR.
    • Right to rectification. The User has the right to request the correction of inaccurate Personal Data and the completion of incomplete Personal Data in accordance with Article 16 of the UK GDPR or, where applicable, Article 16 of the GDPR.
    • Right to erasure. The User has the right to request the erasure of Personal Data where the conditions provided by Article 17 of the UK GDPR or, where applicable, Article 17 of the GDPR are satisfied. The right to erasure is not absolute and shall not apply where continued processing or retention is required or permitted by applicable law.
    • Right to restriction of processing. The User has the right to request restriction of the processing of Personal Data in the circumstances provided by Article 18 of the UK GDPR or, where applicable, Article 18 of the GDPR. Where processing is restricted, the Company may continue to store the relevant Personal Data and may otherwise process it only to the extent permitted by applicable law.
    • Right to data portability. Where the requirements of Article 20 of the UK GDPR or, where applicable, Article 20 of the GDPR are satisfied, the User has the right to receive Personal Data provided by them to the Company in a structured, commonly used and machine-readable format and to transmit such Personal Data to another Controller. Where technically feasible and permitted by applicable law, the User may request that the Company transmit such Personal Data directly to another Controller.
    • Right to object. The User has the right to object to the processing of Personal Data in the circumstances provided by Article 21 of the UK GDPR or, where applicable, Article 21 of the GDPR. Where Personal Data is processed for direct marketing purposes, the User has the right to object to such processing at any time.
    • Rights relating to automated decision-making and profiling. Where the UK GDPR applies and the Company makes a significant decision based solely on automated processing, including profiling, the User shall have the rights and safeguards provided by Articles 22A–22D of the UK GDPR, as applicable, including the right to obtain information concerning such decision, make representations in relation to it and obtain human intervention. Where the GDPR applies, the User has the rights provided by Article 22 GDPR in relation to decisions based solely on automated processing, including profiling, which produce legal effects concerning the User or similarly significantly affect the User.
    • Right to lodge a complaint. The User has the right to lodge a complaint with the competent supervisory authority where the User considers that the processing of their Personal Data infringes applicable data protection legislation. In the United Kingdom, the competent supervisory authority is the Information Commissioner’s Office (ICO).

11. USER RIGHTS (USA)

  1. This section applies to Users who are residents of the United States to the extent that the Company is subject to the privacy and data protection laws applicable in the relevant state. Such laws include, where applicable, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Utah Consumer Privacy Act (UCPA), the Texas Data Privacy and Security Act (TDPSA), the Oregon Consumer Privacy Act (OCPA), and other applicable comprehensive state privacy laws. The scope and conditions for exercising the rights described below may vary depending on the User’s state of residence and the applicability of the relevant law.
  2. Subject to the requirements, limitations and exceptions established by applicable U.S. state privacy law, the User may have the following rights in relation to their Personal Data:
    • Right to know and access. The User may have the right to obtain confirmation as to whether the Company processes Personal Data relating to them and to request access to such Personal Data. Where required by applicable law, the User may also request information concerning the categories of Personal Data processed, the purposes of processing, the categories of sources from which the Personal Data was obtained, and the categories of Third Parties to whom such Personal Data has been disclosed, shared or sold.
    • Right to deletion. The User may have the right to request deletion of Personal Data provided by or obtained about the User, subject to any exceptions permitting or requiring the Company to retain such Personal Data under applicable law.
    • Right to rectification. The User may have the right to request correction of inaccurate Personal Data maintained by the Company, taking into account the nature of the Personal Data and the purposes for which it is processed.
    • Right to data portability. The User may have the right to obtain a copy of their Personal Data in a portable and, where technically feasible, readily usable format that allows the User to transmit the Personal Data to another entity without undue impediment.
    • Right to opt out of the sale of Personal Data. Where applicable law provides such right and the Company engages in processing that constitutes a “sale” of Personal Data within the meaning of that law, the User may direct the Company not to sell their Personal Data.
    • Right to opt out of targeted advertising or sharing of Personal Data for cross-context behavioural advertising. Where provided by applicable law, the User may have the right to opt out of the processing of Personal Data for targeted advertising or, in jurisdictions applying the relevant concept, the sharing of Personal Data for cross-context behavioural advertising.
    • Right to opt out of certain profiling. Where provided by applicable law, the User may have the right to opt out of profiling carried out in furtherance of decisions that produce legal or similarly significant effects concerning the User.
    • Rights relating to sensitive Personal Data. Where the Company processes Personal Data classified as sensitive under applicable U.S. state privacy law, the User may have the right to limit certain uses or disclosures of such Personal Data, or the Company may be required to obtain Consent before carrying out particular processing activities, depending on the requirements of the applicable law.
    • Right to non-discrimination. The Company shall not unlawfully discriminate against a User, deny Services, provide a materially different level or quality of Services, or otherwise subject the User to prohibited adverse treatment solely because the User has exercised a privacy right granted by applicable law.
    • Right to appeal. Where applicable state privacy law provides an appeal mechanism, the User may have the right to appeal the Company’s refusal to take action on a request relating to the exercise of the User’s privacy rights.
  3. The precise combination of these rights differs between state regimes. For example, California provides rights concerning access, deletion, correction, sale/sharing and sensitive Personal Data, while Texas expressly provides access, correction, deletion and opt-out rights concerning targeted advertising, sale and certain profiling.

12. SUBMISSION OF REQUEST

  1. A User may submit a request to exercise any right available to them under applicable data protection or privacy legislation by sending a written request to the Company at the following email address: admin@acrosstheaward.com
  2. The request shall identify the right the User seeks to exercise and contain sufficient information to enable the Company to understand, identify and process the request. Where the information provided is insufficient, unclear or incomplete, the Company may request reasonable additional information or clarification necessary to process the request.
  3. Where reasonably necessary to protect Personal Data against unauthorised disclosure, alteration or deletion, the Company may request information necessary to verify the identity of the person submitting the request. The Company shall request only such verification information as is reasonable and proportionate having regard to the nature of the request and the Personal Data concerned. Where applicable law permits a request to be submitted by an authorised representative, the Company may require reasonable evidence of the representative’s authority to act on behalf of the User.
  4. The Company shall respond to a valid request without undue delay and within the period prescribed by applicable law:
    • where the UK GDPR applies, the Company shall respond as soon as reasonably practicable and, in any event, within one calendar month, subject to any lawful extension or adjustment of the applicable period;
    • where the GDPR applies, the Company shall respond without undue delay and, in any event, within one month of receipt of the request. Where necessary having regard to the complexity or number of requests, this period may be extended by a further two months, provided that the User is informed of the extension and the reasons for it within the initial one-month period;
    • where applicable U.S. state privacy legislation applies, the Company shall respond within the period prescribed by the relevant law. Where the CCPA applies, requests to know, delete or correct shall generally be responded to within 45 calendar days, subject to any extension permitted by applicable law and notice to the User.
  5. Where the Company refuses or is unable to comply with a request, in whole or in part, the Company shall inform the User of the refusal and the reasons for it to the extent required by applicable law and shall provide information concerning any available right to lodge a complaint, appeal the decision or seek another remedy.

13. RESPONSIBILITY

  1. The Company is responsible for the processing of Personal Data carried out by the Company and by Processors acting on its behalf to the extent required by the UK GDPR and, where applicable, the GDPR and other applicable data protection and privacy laws. The Company shall implement and maintain appropriate technical and organisational measures designed to protect Personal Data against unauthorised or unlawful processing, accidental loss, destruction, alteration or disclosure.
  2. The Company shall not be responsible for the independent processing of Personal Data by Third Parties that determine the purposes and means of such processing independently and do not act on behalf of or under the instructions of the Company, including:
    • clients and business partners of the Company that independently receive or process Personal Data in connection with their own products, services, marketing or advertising activities;
    • advertising, marketing, analytics, social media, application distribution and other third-party platforms where such platforms process Personal Data as independent Controllers;
    • websites, applications, platforms or services operated by Third Parties and accessed by the User through links, advertisements, integrations or other references available on the Site or in connection with the Services;
    • other Third Parties to whom the User independently provides Personal Data or with whom the User independently enters into a relationship.
  3. The Company shall not be responsible for any unauthorised access to, loss, alteration, disclosure or other unlawful use of Personal Data resulting solely from:
    • unlawful acts or omissions of Third Parties that are outside the reasonable control of the Company;
    • circumstances beyond the reasonable control of the Company, provided that the Company has complied with the security obligations imposed on it by applicable law;
    • the User’s disclosure of Personal Data to Third Parties independently of the Company;
    • inaccurate, incomplete, false or outdated information provided to the Company by the User or lawfully received by the Company from a Third Party, unless the Company is required by applicable law to correct or otherwise take action in relation to such Personal Data.
  4. The transmission of information over the Internet cannot be guaranteed to be completely secure. The Company applies appropriate technical and organisational measures intended to protect Personal Data during its transmission, storage and processing. However, the Company cannot guarantee absolute security or the complete absence of risks arising from the transmission of Personal Data over the Internet.
  5. The User is responsible for ensuring that Personal Data provided by the User to the Company is accurate, complete and, where applicable, kept up to date. The User shall notify the Company within a reasonable period if Personal Data previously provided to the Company becomes inaccurate or requires correction.
  6. Where the User provides the Company with Personal Data relating to another natural person, the User is responsible for ensuring that:
    • the User is lawfully entitled to disclose such Personal Data to the Company;
    • the disclosure does not violate the rights of the relevant individual or applicable data protection and privacy laws;
    • any Consent required for such disclosure or subsequent processing has been obtained before the Personal Data is provided to the Company;
    • the relevant individual has been provided with any information regarding the processing of their Personal Data that the User is required to provide under applicable law.
  7. The User shall not knowingly provide the Company with:
    • Personal Data obtained unlawfully or without the authority required for its disclosure;
    • false or deliberately misleading Personal Data;
    • special categories of Personal Data or other sensitive information unless the Company has expressly requested such information and its processing is permitted under applicable law.
  8. Where particular Personal Data is objectively necessary for the provision of the Services, performance of contractual obligations or compliance with applicable legal requirements, the Company may be unable to provide the relevant Services or perform the relevant action if the User refuses to provide such Personal Data or requests that processing necessary for that purpose be discontinued.
  9. Nothing in this Privacy Policy shall exclude, restrict or limit any responsibility or liability of the Company, or any right or remedy available to the User, to the extent that such exclusion, restriction or limitation is prohibited by the UK GDPR, the GDPR where applicable, or other applicable law.

14. COOKIES

  1. The Company may use Cookies and similar tracking technologies in connection with the operation of the Site, including web beacons, pixel tags, tags, scripts, local storage technologies and other comparable technologies that enable information to be stored on or accessed from the User’s device or browser.
  2. Web beacons and similar technologies may be embedded in pages of the Site, advertisements or other content. When such technology is loaded, certain technical information may be transmitted or recorded, including the User’s IP address, browser type, date and time of access, the page or content viewed and other information relating to the User’s interaction with the Site.
  3. The Company may use Cookies and similar technologies for the following purposes:
    • to ensure the proper operation, security and technical functionality of the Site;
    • to authenticate Users and maintain sessions where such functionality is available;
    • to remember preferences and settings selected by the User;
    • to analyse the use, performance and effectiveness of the Site and the Services;
    • to collect statistical and analytical information regarding traffic, visits and interaction with the Site;
    • to measure the performance and effectiveness of marketing and advertising activities;
    • to support advertising and marketing activities, including, where permitted by applicable law, the delivery or measurement of advertising based on the User’s interaction with the Site or other online services.
  4. The Company may use:
    • strictly necessary Cookies, where such Cookies are required for the operation, security or functionality of the Site;
    • functional Cookies, which enable the Site to remember the User’s preferences, settings or previous actions;
    • analytics and performance Cookies, which enable the Company to understand how Users interact with the Site, measure traffic and performance and improve the Site and the Services;
    • advertising and marketing Cookies, which may be used to measure advertising campaigns, determine the effectiveness of marketing activities and, where permitted by applicable law, provide advertising relevant to the User’s interests.
  5. Where required by applicable law, the Company shall obtain the User’s Consent before storing or accessing Cookies or similar technologies that are not strictly necessary for the operation of the Site. The User may provide, refuse or withdraw such Consent through the cookie consent mechanism made available on the Site or through other controls provided by the Company.
  6. The User may also control or delete Cookies through the settings of the User’s browser or device. Disabling or rejecting certain Cookies may affect the availability or proper operation of particular functions or elements of the Site.
  7. Third Parties engaged by the Company in connection with advertising, marketing, analytics, technical support or other Services may use Cookies or similar technologies in accordance with applicable law. Where such Third Parties independently determine the purposes and means of processing Personal Data, their use of Cookies and other technologies shall be governed by their respective privacy and cookie policies.
  8. The Site may contain social media features, widgets or other functionality provided by Third Parties. Such functionality may collect technical information, including the User’s IP address and information concerning the page visited, and may use Cookies or similar technologies necessary for the relevant functionality. The User’s interaction with such functionality may also be subject to the privacy terms of the relevant Third Party.
  9. Where advertising technologies are used on or in connection with the Site, Third Parties may process information concerning the User’s interaction with the Site and, where permitted by applicable law and subject to any required Consent, information concerning the User’s activity on other websites or online services for advertising, measurement or analytics purposes.

15. MINORS

  1. The Services are intended for persons who have reached the age of majority in accordance with the laws applicable in their country of residence. The Company does not knowingly collect or process Personal Data relating to persons who have not reached the applicable age of majority.
  2. The Company does not intentionally provide the Services to minors and does not knowingly request Personal Data from them.
  3. If the Company becomes aware that Personal Data relating to a person who has not reached the applicable age of majority has been collected or processed, the Company may delete such Personal Data and, where applicable, discontinue the provision of the Services to such person.
  4. If you become aware that a person who has not reached the applicable age of majority has provided Personal Data to the Company or is receiving the Services, please contact the Company at: admin@acrosstheaward.com.

16. PRIVACY POLICY CHANGES

  1. The Company may amend or update this Privacy Policy from time to time, including where such changes are necessary to reflect changes in the Company’s processing activities, the Services, applicable law, regulatory requirements, or the measures used to protect Personal Data.
  2. Where the Company makes changes to this Privacy Policy, the updated version shall be published on the Site. Where required by applicable law or where the changes materially affect the processing of Personal Data, the Company may provide additional notice to Users.
  3. The Company shall indicate the date on which the current version of this Privacy Policy was published or last updated at the beginning of this Privacy Policy.
  4. The version of this Privacy Policy published on the Site at the relevant time shall constitute the current version applicable to the processing of Personal Data by the Company.

17. CONTACTS

  1. The User has the right to contact the Company support service at: admin@acrosstheaward.com
  2. to ensure his rights, in accordance with the terms of this Privacy Policy, or in case of violation of his rights, or to leave feedback or ask a question.