Information collected
The platform may collect information you enter, records created through campaign participation, and limited technical information generated when the service is used.
Identity and contact data
Participant-provided data may include legal name, country, email address, phone number, and preferred contact method.
Entry and campaign data
The platform associates a submission with the selected campaign, its status, relevant destination, review outcome, and any ticket later issued after approval.
Payment-reference information
For paid campaigns, participants may provide a transaction ID, teller number, transfer reference, selected bank, or selected crypto asset and network. This information supports manual matching; it is not itself proof of approval.
Uploaded evidence or receipts
If a campaign interface supports evidence or receipt uploads, those files may be reviewed with the entry. The current production practice, accepted formats, and storage period must be confirmed before this section is relied upon.
Technical and usage data
Hosting, security, and analytics systems may generate records such as request metadata, device or browser information, error logs, and usage events. The exact production configuration should be documented.
How information is used
Information may be used to operate campaigns, review entries, prevent fraud, issue approved tickets, administer draws, communicate about participation, publish limited winner records, secure the service, and meet legal obligations.
Legal basis — jurisdiction-specific review
The lawful bases for processing depend on the operating jurisdiction and relationship with participants. [INSERT COUNSEL-APPROVED LEGAL BASES].
Manual verification
Administrators may compare participant details, payment references, campaign requirements, and other submitted information before approving or rejecting an entry.
Fraud and security monitoring
Information may be reviewed to detect duplicate submissions, false references, unauthorized activity, abuse, chargebacks, and threats to campaign integrity.
Service providers
Vendors may process information to provide database, authentication, hosting, communications, analytics, or payment-related support. Provider access should be limited to what is needed for their services.
Infrastructure and communications
The application uses cloud database and authentication infrastructure. Production documentation should identify the actual Firestore, Firebase, hosting, email, SMS, analytics, and payment-related providers in use without implying services that are not configured.
International data transfers
Providers or administrators may operate in different countries. Any transfer mechanism, safeguard, or regional restriction must be confirmed and reviewed for the applicable jurisdictions.
Data retention
Information should be retained only for an appropriate business, security, dispute, campaign-record, and legal period. The confirmed schedule is [RETENTION PERIOD]. No automatic deletion schedule is promised by this draft.
Data security
Reasonable organisational and technical safeguards should be maintained. No system is completely secure, and this draft does not claim that all data is encrypted or immune from loss or unauthorized access.
User rights
Depending on location, participants may have rights to request access, correction, deletion, restriction, portability, or objection, and to complain to [DATA PROTECTION AUTHORITY, IF APPLICABLE]. These rights require jurisdiction-specific review.
Children and age restrictions
The platform is not intended for persons below [MINIMUM ENTRY AGE]. Age requirements may also vary by campaign and country. The organiser must establish an appropriate verified minimum age before production use.
Cookies and analytics
Authentication, security, preferences, and analytics may use cookies or similar technologies. A production cookie inventory and consent approach should be documented where required.
Public winner information
Approved ticket data remains distinct from public winner data. After a confirmed draw, the platform may display limited winner information such as participant name, country, ticket number, award, and selection record. Private payment references and contact details should not be displayed publicly.
Policy changes
This policy may be updated as practices, providers, or legal requirements change. The updated date should be revised and material changes communicated appropriately.
Privacy contact and requests
Data controller: [DATA CONTROLLER LEGAL NAME]. Privacy contact: [PRIVACY CONTACT EMAIL]. Replace these placeholders and document the request-verification process before production use.