Privacy Policy

Rafflebags – Privacy Policy

Effective date: 1st May 2026

This Privacy Policy explains how Rafflebags Limited collects, uses and protects your personal data when you visit rafflebags.com (the “Site”), enter our prize draws, sign up to our mailing list, or otherwise interact with us. It is written to comply with the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

—

1. Who we are

Rafflebags Limited (company number 17156239) is the data controller for the personal data we collect about you.

– Registered office: 1010 Eskdale Road, Winnersh Triangle, Wokingham, England, RG41 5TS

– Operational address: Rafflebags, Unit 23–26 The Ridgeway, Stratford-upon-Avon, CV37 9RE

– ICO data protection registration: C1925088

– Contact: hello@rafflebags.com

References to “Rafflebags”, “we”, “us” and “our” mean Rafflebags Limited.

2. The personal data we collect

2.1 Information you give us

When you sign up, enter a Competition (paid or by free post), or contact us, we collect:

– full name
– email address
– postal address (billing/delivery address for paid entries; return address for free postal entries)
– date of birth
– telephone number
– payment details (processed directly by our payment providers — we do not store full card numbers on our systems)
– any other information you choose to give us in correspondence

2.2 Information collected automatically when you use the Site

– IP address and approximate location (city/region) derived from it
– device, browser and operating system information
– pages viewed, time on page, links clicked and other interaction data
– referral source (e.g. the website or advert that brought you to us)
– cookie and similar identifier data (see clause 8)

2.3 Information from third parties

– payment confirmation, fraud signals and chargeback data from our payment providers
– delivery status and exception data from couriers
– aggregated advertising performance data from advertising platforms
– information from publicly available sources where required to verify identity, age or eligibility

3. How we use your data and our lawful bases

We process your data on the following lawful bases under Article 6 of the UK GDPR:

3.1 Performance of a contract with you (Article 6(1)(b))

To accept and process your Entry; to run the Draw and notify the winner; to deliver Prizes; to handle refunds, returns and complaints.

3.2 Compliance with a legal obligation (Article 6(1)(c))

To verify age and eligibility; to meet financial, accounting and tax record-keeping requirements; to respond to lawful requests from regulators, courts and law enforcement.

3.3 Our legitimate interests (Article 6(1)(f))

To prevent and detect fraud, abuse, and unauthorised entry; to secure the Site and our systems; to analyse Site performance and improve our services; to defend or pursue legal claims; to manage our business and corporate transactions.

We have balanced our interests against your rights and only proceed where the processing is proportionate. You can object to processing based on legitimate interests at any time (see clause 9).

3.4 Your consent (Article 6(1)(a))

For email, SMS, WhatsApp and push marketing communications; for non-essential cookies and similar technologies; and for advertising delivered via third-party platforms based on your activity on the Site.

You can withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

4. Marketing

4.1 We will only send you marketing communications where you have given us clear, opt-in consent at the point of registration, entry or sign-up by ticking the relevant box.

4.2 You can opt out of marketing at any time by:

– clicking the “unsubscribe” link in any marketing email;
– replying STOP to any marketing SMS or WhatsApp message; or
– emailing hello@rafflebags.com.

4.3 Opting out of marketing does not stop transactional communications (entry confirmations, draw notifications, Prize delivery updates and other service messages), which we are required to send.

5. Who we share your data with

We share personal data only with the following categories of recipient, all of whom are bound by appropriate confidentiality and data-protection obligations.

5.1 Service providers acting as our processors

– website and hosting infrastructure providers (WordPress hosting and CDN)
– payment service providers — including Stripe and PayPal
– email, SMS and customer-communications providers
– the independent third-party draw verifier that conducts and certifies our Draws
– delivery and courier providers (for Prize fulfilment)
– IT, security, fraud-prevention and analytics providers
– professional advisers (accountants, auditors, lawyers, insurers)

5.2 Advertising platforms

These platforms act as independent or joint controllers in respect of certain advertising activity:

– Meta Platforms (Facebook, Instagram) – via the Meta Pixel and conversions API
– TikTok – via the TikTok Pixel
– Google (Google Ads, Google Analytics 4)

For more on what each platform does with your data, please see their own privacy policies.

5.3 Other recipients

– regulators, authorities and courts where required by law (for example, HMRC, the ICO, the Gambling Commission, law enforcement);
– prospective buyers, investors or successors of our business and their advisers, in connection with a sale, restructure or financing, subject to confidentiality obligations.

We do not sell your personal data.

6. International transfers

Some of our service providers and advertising partners are based outside the UK, including in the United States. Where we transfer personal data outside the UK we rely on appropriate safeguards, including:

– the UK Government’s adequacy regulations where applicable;
– the UK International Data Transfer Agreement (IDTA);
– the UK Addendum to the EU Standard Contractual Clauses; or
– another lawful safeguard listed in the UK GDPR,

together with supplementary measures where appropriate. You can request a copy of the relevant safeguard by emailing hello@rafflebags.com.

7. How long we keep your data

We retain personal data only for as long as necessary for the purposes for which it was collected. Indicative retention periods are:

| Data | Retention |

|—|—|

| Entry records (paid and free) | 7 years from the end of the relevant tax year, to meet HMRC and accounting obligations |

| Account and contact details | While your account is active, and for up to 24 months after your last activity |

| Marketing data | Until you opt out, after which a suppression record is kept indefinitely to honour your opt-out |

| Customer service correspondence | Up to 3 years from the date of last contact |

| Cookie and analytics data | As set out in our cookie banner and in clause 8 |

| Records related to disputes or claims | Until resolution and for any applicable limitation period (typically 6 years) |

After these periods we securely delete or anonymise the relevant personal data.

8. Cookies and similar technologies

The Site uses cookies and similar technologies for essential functions (such as making the Site work and processing Entries), analytics (to understand how the Site is used) and advertising (to deliver and measure adverts).

Non-essential cookies are set only with your consent, given through our cookie banner. You can change your preferences at any time using the cookie settings link in the Site footer.

Among others, the analytics and advertising services we use include:

– Google Analytics 4
– Meta Pixel and Meta Conversions API
– TikTok Pixel

These services may set cookies and similar identifiers and may transfer data to the United States and other countries. They are subject to the safeguards described in clause 6.

9. Your rights

Under UK data protection law you have the following rights, subject to certain limits and exceptions:

– access to your personal data;
– rectification of inaccurate personal data;
– erasure (“right to be forgotten”) in certain circumstances;
– restriction of processing in certain circumstances
– portability of data you have provided to us, where processing is based on consent or contract;
– objection to processing based on legitimate interests, including to direct marketing (this last is an absolute right);
– withdrawal of consent where processing is based on consent;
– not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (we do not carry out such automated decision-making);
– to lodge a complaint with the Information Commissioner’s Office at [ico.org.uk](https://ico.org.uk) or 0303 123 1113. We would, however, appreciate the chance to deal with your concerns directly first.

To exercise any of these rights, email hello@rafflebags.com. We aim to respond within one month of receiving your request and any required identification.

10. Data security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS), restricted access controls, secure authentication, hosting with reputable providers, and regular review of our security practices. However, no system can be guaranteed entirely secure and you submit personal data at your own risk.

11. Children

Our Site and our Competitions are not intended for anyone under 18. We do not knowingly collect personal data from anyone under 18. If you believe we hold personal data of someone under 18, please contact us at hello@rafflebags.com and we will delete it.

12. Changes to this Policy

We may update this Privacy Policy from time to time. The “Effective date” at the top of this page will reflect the latest version. Material changes will be notified to you by email or by a prominent notice on the Site before they take effect.

13. How to contact us

– Email: hello@rafflebags.com
– Post: Rafflebags, Unit 23–26 The Ridgeway, Stratford-upon-Avon, CV37 9RE
– Data protection regulator: Information Commissioner’s Office — [ico.org.uk](https://ico.org.uk), 0303 123 1113.