Privacy Policy

We collect the personal data we need to verify you are over 18, process your competition entries, contact you if you win, and ship your prize. We do not sell your data, we do not run advertising or remarketing cookies, and we use UK or EU-based processors only. You can exercise any of your UK GDPR rights at any time by emailing info@chooseyouraffles.co.uk. The full policy below explains exactly what we hold and why.

Choose You Raffles is operated by Choose You Raffles LTD, a company registered in Scotland (company number SC890793). We are the data controller for personal data collected via this website. For any data-protection question or request, contact info@chooseyouraffles.co.uk.

We collect the following personal data when you register and use our service:

• Name, email address, date of birth, UK postcode (registration)
• Phone number (optional, asked at first purchase)
• Marketing consent (optional)
• Order history, ticket numbers, and the Paytriot payment reference for each order (we do not receive or store your card details: no card number, card brand, last four digits, or CVV)
• Server logs of your interactions with the site (IP address, user agent, paths visited, request timing)

• To verify you are a UK resident aged 18 or over (operating requirement under our DCMS Voluntary Code commitment)
• To process your competition entries and payments
• To contact you if you win and to deliver your prize
• To send order confirmations and (with your consent) marketing updates
• To detect and prevent fraud, abuse, and breaches of our Terms
• To meet our legal obligations under UK competition, tax, and consumer-protection law
• To understand how the site is used and improve it (analytics, consent-gated)

• Contract: processing entries, taking payment, delivering prizes
• Legal obligation: age verification, HMRC retention
• Legitimate interests: fraud prevention, security, service improvement (we balance this against your rights and you can object at any time)
• Consent: marketing communications and analytics cookies (you can withdraw consent at any time without affecting prior lawful processing)

We share the minimum personal data needed with the following processors and recipients:

• Paytriot Secure Payments (card payment processing for paid entries). When you pay for tickets, your card details are entered into Paytriot’s secure payment form and processed solely by Paytriot. We receive only a payment outcome and reference for your order; we never receive or store your card number, card brand, last four digits, or security code.
• Amazon Web Services EMEA SARL (hosting, database, transactional email via Amazon SES; eu-west-2 London region)
• Sentry (Functional Software, Inc.) (error monitoring, EU region; technical error reports only, no marketing use)
• PostHog (PostHog, Inc.) (usage analytics, EU region, never for advertising). Browsing analytics run only when you accept analytics cookies in the consent banner. Separately, when you place an order our own servers record the order’s progress (order created, payment outcome, tickets allocated, any refund) against your account reference so we can monitor that entries and payments are working correctly; these server records use no cookies and include no browsing history
• Our courier (shipping prizes; name and address only)
• HM Revenue & Customs, the Gambling Commission, the Information Commissioner’s Office, or law enforcement where legally required

We never sell your personal data. We never share it for third-party marketing.

All core processing happens in the UK or the European Economic Area (AWS eu-west-2 London for hosting and email, Sentry EU region for error monitoring, Frankfurt). We do not transfer personal data to the United States or other jurisdictions without UK adequacy decisions. If that ever changes, this policy will be updated and material changes notified to registered customers by email before they take effect.

• Account profile and order history: 7 years after account closure (HMRC retention rules)
• Draw records (seed, eligible-tickets list, winner data): 7 years per DCMS Voluntary Code transparency commitment
• Marketing consent records: until you withdraw consent, then 12 months
• Server logs: 90 days
• Error reports (Sentry): 90 days, then aggregated and the raw report is deleted

Under the UK GDPR you have the following rights, free of charge:

• Access: ask for a copy of the personal data we hold about you
• Rectification: ask us to correct anything inaccurate
• Erasure: ask us to delete your data (subject to legal retention rules above)
• Restriction: ask us to pause processing in some circumstances
• Portability: receive your data in a machine-readable format
• Object: object to processing based on legitimate interests, including to direct marketing without justification
• Withdraw consent: at any time, for marketing or analytics, without affecting prior lawful processing
• Not be subject to solely automated decisions with legal or similarly significant effects (we do not make any such decisions)

To exercise any of these rights, email info@chooseyouraffles.co.uk. We will respond within one calendar month. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk. See our data complaints page for our 30-day acknowledgement commitment under DUAA 2025.

Our service is for adults aged 18 or over only. We do not knowingly collect personal data from anyone under 18. If you believe we hold data about a child, contact us at info@chooseyouraffles.co.uk and we will delete it.

We do not make any decisions about you based solely on automated processing that produces legal effects or significantly affects you. We do not build customer profiles for marketing purposes.

Marketing emails are sent only with your consent, which you can withdraw at any time using the unsubscribe link in any email or by changing your preferences in your account. Operational messages (order confirmations, ticket numbers, winner notifications) are sent under contract and cannot be opted out of while you have an active entry.

See our Cookie Policy for the full list of cookies and browser-storage items we set, their purpose, and how to control them.

We will update this policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be notified to registered customers by email at least 14 days before they take effect.