Privacy
& GDPR Policy

1. Data We Collect

We collect personal information directly from you when you register, enter a competition, or interact with us. This includes:

• Identity Data: First name, last name, and date of birth (required to verify you are 18+).
• Contact Data: Email address, telephone number, billing address, and physical delivery address.
• Transaction Data: Details of competition tickets purchased, payment history, and secure payment identifiers.
• Technical Data: IP address, device type, operating system, browser type, and interaction logs with our website.

2. Legal Basis for Processing

Under UK GDPR, we must have a valid legal basis to process your personal data. We rely on the following bases:

• Performance of a Contract: To manage your competition entries, process payments, allocate ticket numbers, and deliver prizes (e.g., executing the transaction).
• Legal Obligation: To verify your age (18+) and identity in compliance with UK laws, consumer protection regulations, and key tax guidelines.
• Legitimate Interests: To optimize our platform, ensure system security, prevent fraud, and run our business effectively.
• Consent: For marketing emails or non-essential cookies. You can withdraw your consent at any time.

3. International Data Transfers

Some of our service providers (such as Clerk for authentication and Vercel for hosting) operate or process data outside the UK and European Economic Area (EEA), primarily in the United States.

• All international transfers are protected by standard contractual clauses (SCCs) approved by the UK Information Commissioner's Office (ICO).
• These agreements guarantee that your data is processed to the same high security standards as it would be within the UK.

4. Your Rights Under UK GDPR

You possess comprehensive rights regarding your personal information, which you can exercise at any time:

• Right of Access: You can request a complete copy of all personal data we hold about you.
• Right to Rectification: You can request that we correct any inaccurate or incomplete information.
• Right to Erasure (Right to be Forgotten): You can request that we delete your personal data under certain conditions.
• Right to Portability: You have the right to receive your data in a structured, commonly used, and machine-readable format to transfer it to another provider.
• Right to Object: You have the absolute right to object to the processing of your data for direct marketing purposes.
• Right to Restrict Processing: You can request that we restrict how we process your data while resolving a dispute.

5. Data Security & Retention

We implement advanced security measures, including SSL encryption and secure cloud databases, to protect your data. We retain your personal data only as long as necessary to fulfill the purposes for which it was collected, or to satisfy legal, accounting, or reporting requirements (typically 6 years for tax and transaction records in the UK).

6. Right to Complain to the ICO

If you believe we have not processed your data in compliance with UK GDPR, you have the right to make a formal complaint to the UK Information Commissioner's Office (ICO):

• ICO Website: https://ico.org.uk
• Helpline: 0303 123 1113
• We would, however, appreciate the chance to address your concerns directly first, so please contact support@balkanraffle.co.uk.