Privacy Policy

1. Introduction

Raffio ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our skill-based prize competition platform ("the Platform").

We process personal information only where the law allows us to — because it is necessary to run the competitions you enter, because we have a legal obligation, because we have a legitimate interest that is not overridden by your rights, or, for a small number of optional things such as marketing email, because you have given consent you can withdraw at any time. Section 4 lists the legal bases we rely on; a purpose-by-purpose mapping of each processing activity to its basis is being finalised with our solicitors and will be published in this policy before launch.

This policy explains how Raffio currently processes personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and is under final legal review before launch. If you are located outside the UK, additional laws may apply.

2. Information We Collect

2.1 Information You Provide

We collect information you provide directly to us, including:

• Account Information: Name, email address, username and profile information. Sign-in and passwords are handled by our authentication provider (Clerk) — Raffio never receives or stores your password
• Payment Information: Payment records such as amounts, payment status and history. Card payments are processed by our payment provider — Raffio never receives or stores your full card number
• Listing Information: If you are a host, we collect item descriptions, images, pricing, and other listing details
• Transaction Information: Details of tickets purchased, competitions entered, and transactions completed
• Communication Information: Messages sent through the Platform, customer support inquiries, and feedback
• Delivery Information: Delivery addresses and contact details collected from winners for prize fulfilment

2.2 Information Automatically Collected

When you use the Platform, we automatically collect certain information, including:

• Device Information: IP address, browser and operating-system details sent with each request
• Usage Information: A deliberately limited set of product-analytics events. Our analytics are configured conservatively: no automatic capture of every click, no session recording, and usage profiles only for signed-in users
• Technical Information: Log files, error reports, and performance data

2.3 Information from Third Parties

We may receive information about you from third parties, including:

• Authentication providers (e.g., Clerk) when you sign in using third-party accounts
• Payment processors regarding transaction status and payment methods
• Our host identity-verification provider (Didit), if you apply to become an approved host

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Platform Operation

• Create and manage your account
• Process transactions and payments
• Administer competition entries and winner selection
• Manage communication about your entries, prize claims and fulfilment (all of which goes through Raffio)
• Deliver items to winners
• Provide customer support

3.2 Platform Improvement

• Analyse usage patterns and user behaviour
• Improve Platform functionality and user experience
• Develop new features and services
• Conduct research and analytics

3.3 Communication

• Send transactional emails (confirmations, winner notifications, etc.)
• Send marketing communications (with your consent, which you can withdraw at any time)
• Respond to your inquiries and support requests
• Send important updates about the Platform or your account

3.4 Legal and Security

• Comply with legal obligations and regulatory requirements
• Detect, prevent, and address fraud, security threats, and abuse
• Enforce our Terms of Service and other policies
• Protect the rights, property, and safety of Raffio, our users, and others
• Respond to legal requests and court orders

4. Legal Basis for Processing (UK GDPR)

We process your personal information based on the following legal bases. Our solicitors are producing the definitive purpose-by-purpose mapping of each processing activity to its basis, which will replace this summary:

• Contract Performance: To perform our contract with you (processing transactions, operating the competitions you enter)
• Legitimate Interests: To operate and improve the Platform, prevent fraud, and ensure security
• Consent: For marketing communications and optional features (you can withdraw consent at any time)
• Legal Obligation: To comply with applicable laws, regulations, and court orders
• Vital Interests: To protect the safety and security of users

Publishing limited winner information (see section 5.3) is expected to rely on our legitimate interests in demonstrating that prizes are genuinely awarded, balanced against your right to object. That basis, and the balancing assessment behind it, are being confirmed with our solicitors and this section will be updated before launch. You can object to publication of your personal information at any time, and we will act on it — see section 5.3.

5. Information Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

5.1 Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Payment processors for transaction processing
• Cloud hosting providers for data storage
• Email service providers for communications
• Analytics providers for usage analysis

Customer support is handled by Raffio itself — support cases live in Raffio's own systems and replies are sent through our transactional email provider; no external customer-support platform receives your data.

These service providers are contractually obligated to protect your information and use it only for the purposes we specify.

Independent draw service (RANDOM.ORG). To conduct each draw, we send RANDOM.ORG's Third-Party Draw Service the competition's ticket-number list and draw reference. We do not send names, email addresses, telephone numbers, postal addresses, account identifiers or payment information. RANDOM.ORG publishes an official public record of the draw showing those ticket numbers. Ticket numbers do not publicly identify anyone by name, but Raffio holds the internal record linking each ticket to its entrant; the data-protection treatment of these identifiers is being confirmed with our solicitors. The record is publicly visible on RANDOM.ORG's site, is retained by RANDOM.ORG under its own retention terms, and cannot be amended or deleted by Raffio once the draw completes.

Postal-entry handling. Free postal entries are delivered to Raffio's operational postal receiving address. A postal-address or mail-handling provider may receive the physical item before it is processed by Raffio. The precise handling, access and retention arrangements are being confirmed and will be stated in the final policy before launch.

5.2 Winner Fulfilment

If you win a prize supplied by an approved host, we share with that host only the minimum delivery details needed for your chosen fulfilment method (for example, a delivery address for a courier dispatch), and only after Raffio has approved your claim. The host’s access is audited and ends when your claim closes, and the encrypted delivery details are irreversibly removed 90 days after the claim closes (this period is under final legal review). Hosts do not contact winners directly, we do not share hosts’ contact information with winners, and all communication about your prize goes through Raffio.

5.3 Publishing Limited Winner Information

We never publish entrant names or any mapping between entrants and their tickets (the independent RANDOM.ORG draw record shows the ticket-number list used for the draw, without any public mapping between those ticket numbers and entrant names — see section 5.1). For a confirmed winner of a major prize we may publish or make available limited winner information alongside the competition and draw evidence — normally the winner's surname and their county or region, shown with the winning ticket number. We do not publish a winner's first name, address, email address, telephone number, account identifiers, payment information or the contents of their prize claim.

We tell entrants about this at or before entry. You can object to publication of your personal information, or ask us to publish less (for example county only, or surname only), at any time in your account settings, on your winner's claim page, or by contacting us — including after a result has been published. Your choice does not affect your entry, how it is treated in the draw, your payment, your eligibility or your prize, and we do not make the choice itself public.

Whatever you choose, we keep the full winner record internally for prize fulfilment, audit and regulatory purposes, including responding to an advertising-standards or regulatory enquiry.

The data-protection lawful basis we rely on for this publication is being confirmed with our solicitors and this section will be updated before launch.

5.4 Legal Requirements

We may disclose information if required by law, regulation, court order, or government request, or to:

• Comply with legal obligations
• Respond to legal process
• Protect our rights and property
• Prevent fraud or abuse
• Protect the safety of users or the public

5.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change in ownership.

5.6 With Your Consent

We may share information with third parties when you explicitly consent to such sharing.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest, including additional encryption of winner delivery details
• Secure authentication and access controls
• Card payments handled entirely by our payment provider's hosted payment page — full card numbers never touch Raffio's systems

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

7. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Specifically:

• Account Information: Retained while your account is active and for a reasonable period after account closure to comply with legal obligations
• Transaction Records: Retained for at least 7 years to comply with financial and tax regulations
• Marketing Data: Retained until you withdraw consent or unsubscribe
• Legal Records: Retained as required by applicable law or for dispute resolution

When we no longer need your information, we will securely delete or anonymise it in accordance with our data retention policies.

8. Your Rights (UK GDPR)

Under UK GDPR and applicable data protection laws, you have the following rights:

8.1 Right of Access

You have the right to request a copy of the personal information we hold about you.

8.2 Right to Rectification

You have the right to request correction of inaccurate or incomplete information.

8.3 Right to Erasure ("Right to be Forgotten")

You have the right to request deletion of your personal information, subject to certain legal exceptions (e.g., we may need to retain transaction records for legal compliance).

8.4 Right to Restrict Processing

You have the right to request that we limit how we use your information in certain circumstances.

8.5 Right to Data Portability

You have the right to receive your personal information in a structured, commonly used, and machine-readable format.

8.6 Right to Object

You have the right to object to processing of your information for direct marketing purposes or based on legitimate interests.

8.7 Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw consent at any time.

To exercise these rights, please contact us using the information provided in Section 13. We will respond to your request within one month, though this may be extended in complex cases.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and store information about your use of the Platform. Cookies are small text files placed on your device when you visit our website.

9.1 Types of Cookies We Use

• Essential Cookies: Required for the Platform to function (authentication, security, basic functionality)
• Analytics Cookies: Help us understand how users interact with the Platform
• Advertising Cookies: The Meta (Facebook) Pixel, which lets us measure whether our adverts on Meta platforms bring visitors to the Platform. It is only loaded if you accept optional cookies
• Functional Storage: Remembers choices you make on this device, such as your cookie-consent choice

Analytics and advertising cookies are off by default and are only set if you choose “Accept all” in our cookie banner.

9.2 Managing Cookies

You can control cookies through your browser settings. However, disabling certain cookies may affect Platform functionality. You can also manage cookie preferences through our cookie consent banner.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws than your country.

When we transfer data outside the UK or EEA, we ensure appropriate safeguards are in place, such as:

• UK adequacy regulations recognising the recipient country's data protection standards
• The UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses
• Other safeguards approved under UK law

The specific mechanism relied on for each service provider is being confirmed against each provider's current data-processing agreement with our solicitors, and this section will state it before launch.

11. Children's Privacy

The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that an account holder is under 18, we restrict the account so it cannot enter competitions, and we retain a minimal record of the restriction itself so the block is durable. Which other personal information must then be deleted, what may be retained as evidence of the restriction, and for how long, are being confirmed with our solicitors.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated policy on the Platform with a new "Last updated" date
• Sending an email notification to registered users (for significant changes)
• Displaying a notice on the Platform

This policy is a description of how we process personal information, not a contract you accept by using the Platform. Where a specific activity needs your consent, we ask for it separately.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@raffio.co.uk (or through the Platform's contact form)
• Platform: Through your account settings or customer support

If you make a data-protection complaint, we will acknowledge receipt within 30 days. Without undue delay, we will take appropriate steps to investigate it, keep you informed where appropriate and communicate the outcome. You can complain by emailing privacy@raffio.co.uk or through the Platform's contact form. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.