Privacy Policy
How TradesRaffle collects, uses, shares and protects personal information when you use the website, create an account, enter a competition or contact us.
Replace every highlighted placeholder with the legal controller name, full address and company number. The retention periods must also match the business’s implemented deletion process.
1. Who controls your data
TradesRaffle is operated by [INSERT LEGAL ENTITY / SOLE TRADER NAME]. The data controller is [INSERT CONTROLLER NAME] of [INSERT FULL BUSINESS ADDRESS].
Privacy contact: support@tradesraffles.com.
2. Information we collect
- Account and eligibility details: name, email, phone, password hash, age/terms confirmations, role, marketing preference, subscription status and any subscription ticket balance linked to your account.
- Competition information: paid and promotional entry quantities, qualifying answers, skill-game marker coordinates, postal-entry details, instant-win results, judging/ranking status and entry history.
- Order and account-value information: order reference, competition items, amounts, payment/refund status, site credit balances and transactions, subscription ticket usage, and contact details supplied at checkout. TradesRaffle does not store full card numbers.
- Identity-check information for selected potential winners: provider session identifier, request/status dates and result. Documents and selfies submitted to a hosted identity provider are not copied into the TradesRaffle database.
- Messages sent through the contact form and related support correspondence.
- Email records including messages queued to you, delivery status, marketing consent and an email suppression record when you unsubscribe.
- Security and technical information including IP-derived rate-limit records, session tokens, password-reset token hashes, browser information and server logs.
- Basket and interface preferences stored locally in your browser.
3. Why we use it and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Create and secure accounts; administer entries, orders, refunds, subscription tickets, site credit, instant-win outcomes, skill judging and prizes | Performance of a contract and legitimate interests in running competitions fairly |
| Process payments, prevent fraud and maintain audit records | Contract, legitimate interests and legal obligations |
| Check age, identity, eligibility and potential winners | Contract, legal obligations and legitimate interests in preventing fraud and awarding prizes correctly |
| Answer enquiries and complaints | Contract steps and legitimate interests in customer support |
| Keep tax, accounting, dispute and regulatory records | Legal obligation and legitimate interests |
| Send optional marketing | Consent, or another basis only where electronic-marketing law permits it |
Where we rely on legitimate interests, those interests include protecting entrants, securing the service, preventing abuse and operating a fair and auditable competition.
4. When information is required
Account and competition information marked as required is needed to create the account, accept an entry, process an order or award a prize. If it is not supplied, we may be unable to provide that service. Marketing is optional. Factual service messages about an account, order, refund, entry, closing date, result or prize are separate from marketing and may still be sent where needed to provide the service.
5. Who receives information
- The payment provider displayed at checkout, for payments, refunds, fraud prevention and disputes.
- A hosted identity provider, such as Stripe Identity if enabled, when a selected potential winner starts a check.
- Website hosting, email, security and technical providers.
- Prize suppliers, couriers and fulfilment partners where necessary to supply or deliver a prize.
- Professional advisers, insurers, authorities or regulators where required or permitted by law.
We do not sell personal information as a customer list.
6. International transfers
Some providers may process information outside the UK. Where UK data-protection law requires it, we use an adequacy regulation, the UK International Data Transfer Agreement/addendum, or another lawful safeguard. Contact us for information about the safeguard relevant to your data.
7. How long we keep information
- Account records: while the account is open and afterwards only as needed for disputes, fraud prevention and legal duties.
- Order, entry, refund, site credit, subscription, instant-win, prize and accounting records: normally up to six years after the relevant transaction, competition or accounting period, and longer only where a dispute or legal requirement applies.
- Live sign-in sessions: normally seven days unless ended earlier by logout or security action.
- Password-reset links: expire after 30 minutes; expired and superseded tokens are removed during reset requests.
- Support messages and server/security logs: only for the period reasonably needed to answer the enquiry, investigate issues and protect the service.
- Identity status: reviewed and deleted or anonymised when no longer needed for verification, dispute or legal purposes. The hosted provider applies its own retention policy to documents submitted to it.
8. Cookies and local storage
We use an essential secure session cookie to keep signed-in users authenticated and browser local storage to remember basket contents and interface state. The current site does not deliberately place advertising or analytics cookies. If non-essential tracking is added later, this notice and the consent controls must be updated before it is enabled.
9. Automated processing
Skill-game entries may be automatically ranked by mathematical distance from a judging panel’s selected point. Ticket numbers may also be allocated automatically from available entries, and Instant Win outcomes may be identified automatically when an allocated ticket matches a predetermined winning outcome. These processes support competition administration and results, but eligibility, verification and final prize-award decisions remain subject to human review. We do not currently use solely automated decision-making that produces legal or similarly significant effects outside the competition mechanisms described in this policy and the applicable competition rules.
10. Your rights
Depending on the circumstances, you may ask for access, correction, erasure, restriction, portability or object to processing. You may withdraw marketing consent at any time using the unsubscribe link in a marketing email or by emailing support@tradesraffles.com. We retain a minimal suppression record so that your address is not accidentally added back to marketing sends. Withdrawing consent does not affect earlier lawful processing.
To exercise another privacy right, email support@tradesraffles.com. We may need to verify your identity. You may complain to the Information Commissioner’s Office.
11. Security and changes
We use technical and organisational measures designed to protect personal information, including hashed passwords, restricted administrative access, secure cookies, HTTPS and security controls designed to reduce unauthorised access or misuse. No online system can be guaranteed to be completely secure. If a personal data breach occurs, we will investigate and assess it and will notify affected individuals and/or the Information Commissioner’s Office where required by law. We may update this policy when our services, providers, security measures or legal requirements change; the date at the top shows the latest version.
12. Contact details
Legal name: [INSERT LEGAL NAME]
Address: [INSERT FULL BUSINESS ADDRESS]
Company number, if applicable: [INSERT COMPANY NUMBER]
Email: support@tradesraffles.com