Privacy Policy

1. Introduction

Raffio ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our skill-based prize competition platform ("the Platform").

By using the Platform, you consent to the data practices described in this Privacy Policy. If you do not agree with this policy, please do not use the Platform.

This Privacy Policy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you are located outside the UK, additional laws may apply.

2. Information We Collect

2.1 Information You Provide

We collect information you provide directly to us, including:

• Account Information: Name, email address, username, password, and profile information
• Payment Information: Payment card details (processed securely through third-party payment processors), billing address, and payment history
• Listing Information: If you are a host, we collect item descriptions, images, pricing, and other listing details
• Transaction Information: Details of tickets purchased, raffles entered, and transactions completed
• Communication Information: Messages sent through the Platform, customer support inquiries, and feedback
• Delivery Information: Shipping addresses and contact details for winner fulfillment

2.2 Information Automatically Collected

When you use the Platform, we automatically collect certain information, including:

• Device Information: IP address, device type, operating system, browser type, and device identifiers
• Usage Information: Pages visited, time spent on pages, links clicked, search queries, and interactions with the Platform
• Location Information: General location data based on IP address (country/region level)
• Technical Information: Log files, error reports, and performance data

2.3 Information from Third Parties

We may receive information about you from third parties, including:

• Authentication providers (e.g., Clerk) when you sign in using third-party accounts
• Payment processors regarding transaction status and payment methods
• Social media platforms if you connect your social media accounts
• Public databases and data providers for verification purposes

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Platform Operation

• Create and manage your account
• Process transactions and payments
• Facilitate raffle entries and winner selection
• Enable communication between buyers and hosts
• Deliver items to winners
• Provide customer support

3.2 Platform Improvement

• Analyse usage patterns and user behaviour
• Improve Platform functionality and user experience
• Develop new features and services
• Conduct research and analytics
• Personalise content and recommendations

3.3 Communication

• Send transactional emails (confirmations, winner notifications, etc.)
• Send marketing communications (with your consent, which you can withdraw at any time)
• Respond to your inquiries and support requests
• Send important updates about the Platform or your account

3.4 Legal and Security

• Comply with legal obligations and regulatory requirements
• Detect, prevent, and address fraud, security threats, and abuse
• Enforce our Terms of Service and other policies
• Protect the rights, property, and safety of Raffio, our users, and others
• Respond to legal requests and court orders

4. Legal Basis for Processing (UK GDPR)

We process your personal information based on the following legal bases:

• Contract Performance: To fulfill our contract with you (processing transactions, facilitating raffles)
• Legitimate Interests: To operate and improve the Platform, prevent fraud, and ensure security
• Consent: For marketing communications and optional features (you can withdraw consent at any time)
• Legal Obligation: To comply with applicable laws, regulations, and court orders
• Vital Interests: To protect the safety and security of users

5. Information Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

5.1 Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Payment processors for transaction processing
• Cloud hosting providers for data storage
• Email service providers for communications
• Analytics providers for usage analysis
• Customer support platforms

These service providers are contractually obligated to protect your information and use it only for the purposes we specify.

5.2 Winner Fulfillment

If you are a host, we may share your contact information with winners to facilitate item delivery. If you are a winner, we may share your delivery information with hosts to enable fulfillment.

5.3 Legal Requirements

We may disclose information if required by law, regulation, court order, or government request, or to:

• Comply with legal obligations
• Respond to legal process
• Protect our rights and property
• Prevent fraud or abuse
• Protect the safety of users or the public

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change in ownership.

5.5 With Your Consent

We may share information with third parties when you explicitly consent to such sharing.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Secure authentication and access controls
• Regular security assessments and updates
• Employee training on data protection
• Secure payment processing through PCI-compliant providers

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Specifically:

• Account Information: Retained while your account is active and for a reasonable period after account closure to comply with legal obligations
• Transaction Records: Retained for at least 7 years to comply with financial and tax regulations
• Marketing Data: Retained until you withdraw consent or unsubscribe
• Legal Records: Retained as required by applicable law or for dispute resolution

When we no longer need your information, we will securely delete or anonymise it in accordance with our data retention policies.

8. Your Rights (UK GDPR)

Under UK GDPR and applicable data protection laws, you have the following rights:

8.1 Right of Access

You have the right to request a copy of the personal information we hold about you.

8.2 Right to Rectification

You have the right to request correction of inaccurate or incomplete information.

8.3 Right to Erasure ("Right to be Forgotten")

You have the right to request deletion of your personal information, subject to certain legal exceptions (e.g., we may need to retain transaction records for legal compliance).

8.4 Right to Restrict Processing

You have the right to request that we limit how we use your information in certain circumstances.

8.5 Right to Data Portability

You have the right to receive your personal information in a structured, commonly used, and machine-readable format.

8.6 Right to Object

You have the right to object to processing of your information for direct marketing purposes or based on legitimate interests.

8.7 Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw consent at any time.

To exercise these rights, please contact us using the information provided in Section 12. We will respond to your request within one month, though this may be extended in complex cases.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and store information about your use of the Platform. Cookies are small text files placed on your device when you visit our website.

9.1 Types of Cookies We Use

• Essential Cookies: Required for the Platform to function (authentication, security, basic functionality)
• Analytics Cookies: Help us understand how users interact with the Platform
• Functional Cookies: Remember your preferences and settings
• Marketing Cookies: Used to deliver relevant advertisements (with your consent)

9.2 Managing Cookies

You can control cookies through your browser settings. However, disabling certain cookies may affect Platform functionality. You can also manage cookie preferences through our cookie consent banner (where applicable).

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws than your country.

When we transfer data outside the UK or EEA, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the UK Information Commissioner's Office
• Adequacy decisions recognising the recipient country's data protection standards
• Other appropriate safeguards as required by law

11. Children's Privacy

The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child under 18, we will take steps to delete such information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated policy on the Platform with a new "Last updated" date
• Sending an email notification to registered users (for significant changes)
• Displaying a notice on the Platform

Your continued use of the Platform after changes become effective constitutes acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@raffio.co.uk (or through the Platform's contact form)
• Platform: Through your account settings or customer support

If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.