Privacy Policy

1. Who controls your data

Drawyz Ltd (company number 17188146), 128 City Road, London, EC1V 2NX, United Kingdom, is the data controller. Contact: drawyz.lc@gmail.com.

2. What we collect

• Account: name, email address, password (stored encrypted by our authentication provider).
• Eligibility and delivery: date of birth, postal address, country.
• Entries: your answers, tickets, orders (paid, loyalty points or free postal entries) and loyalty points.
• Campaign: only if you accept cookies, the link that brought you to Drawyz (for example "instagram") is saved with your account so we can measure our own campaigns.
• Payments: processed by Stripe. We receive the payment status and amount, never your full card number.
• Technical: essential cookies that keep you signed in, and server logs for security.

3. Why we use it (lawful basis)

• To run the competitions you enter and deliver prizes (contract).
• To check age and eligibility and to keep records required by law (legal obligation / legitimate interests).
• To prevent fraud and keep the service secure (legitimate interests).
• To publish winners, only with the winner's consent (consent).

4. Who we share it with

Our service providers, only as needed: Supabase (database and accounts), Stripe (payments), Vercel (hosting), Resend (emails), and delivery companies for prizes. Some providers may process data outside the UK under appropriate safeguards.

5. How long we keep it

Account data while your account is open, and entry and payment records for 6 years for legal and accounting purposes.

6. Your rights

You can ask to access, correct or delete your data, object to or restrict its use, and ask for a copy (data portability). Contact drawyz.lc@gmail.com. You can also complain to the Information Commissioner's Office (ico.org.uk).