Privacy Policy

1.Introduction

This Privacy Policy explains how Local Draws Limited ("we", "us", "our") collects, uses, stores and protects your personal data.

Local Draws is a prize draw platform. We run prize draws in UK cities, and some draws that are open across the UK. Some prizes we buy ourselves. Others are provided by businesses we work with, which we call Prize Partners. People buy entries for a chance to win, and every draw also has a free postal entry route. Entry is open to people aged 18 and over only.

We are committed to protecting your personal data and to complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

Please read this policy alongside our Terms and the rules for each draw.

2.Who we are and how to contact us

Local Draws Limited is the data controller responsible for your personal data. This means we decide why and how your personal data is used, and we are accountable for it.

You can contact us about anything in this policy, or to exercise any of your rights, in either of these ways:

• Email: hello@localdraws.com
• Post: Data Protection, Local Draws Limited, 70 Marsland Road, Sale, M33 3HG

We are registered with the Information Commissioner's Office as a data controller. If you need our registration number for your own records, please ask and we will provide it.

3.Who and what this policy covers

This policy applies to you if you are:

• someone who visits our website
• someone who holds a Local Draws account
• someone who enters a draw, whether by paying or by the free postal route
• someone who wins a prize
• someone a winner has asked us to let use a prize in their place, where we have agreed to that
• someone who joins a Notify list for a city that has not launched yet
• someone who contacts our support team
• a person at a business who enquires about running a draw with us, or who works for a Prize Partner

It covers the public Local Draws website, the logged in account area, email correspondence with our support team, and our social media pages and direct messages.

We do not have a mobile app. If we launch one, this policy will be updated first.

4.How we collect your personal data

We collect personal data in three ways.

Directly from you. When you create an account, enter a draw, claim a prize, join a Notify list, contact support, or send us a business enquiry.

Automatically, when you use our website. Limited technical information such as your device and browser type and general performance information. See section 14 and our Cookie Policy.

From third parties. We receive information back from the companies who help us run the service. Specifically:

• Google or Apple, if you choose to sign in using your Google or Apple account. In that case they confirm your identity to us and pass us your name and email address. They do not pass us your password, and we never see it
• Didit returns the outcome of an identity and age check we ask it to perform on a winner
• DNA Payments returns the outcome of a card payment, and a masked reference to the card used
• Clerk provides the account identity information used to sign you in

5.The personal data we collect

Depending on how you use Local Draws, we may collect and process the following.

Identity data. Your name. For winners, the identity information needed to verify you.

Contact data. Your email address. For winners, a phone number or postal address where needed to fulfil a prize. For free postal entries, the details you write on your entry.

Account data. Your login credentials and account identifiers, held by Clerk on our behalf. We do not see or store your password. If you sign in using your Google or Apple account, we hold the identifier those services give us so that we can recognise you next time, and the name and email address they pass to us.

Referral data. Your own referral code, and — if you signed up using somebody else's — whose code you used. We hold nothing at all about a person who has not signed up. We do not send invitations on anybody's behalf.

Entry data. Which draws you entered, how many entries you hold, when you entered, and whether the entry was paid or came through the free postal route.

Points data. The points you have earned, and what earned them — which entry, or which referral. Points are recorded as a running list of what you earned and when, rather than as a single total, so we can always show you where a figure came from.

Payment data. The amount, the date, whether the payment succeeded, and a masked reference to the card used. We never see or store your full card details. Those go directly to DNA Payments.

Verification data. For winners only, collected on our behalf by Didit when you claim a prize:

• information read from your identity document, being your name, date of birth, nationality, document number and place of issue
• a selfie, and video used to confirm a real person is present
• biometric data, being measurements derived from the geometry of your face, used to confirm the selfie matches your document
• your IP address, device information and the general location inferred from your network connection
• the pass or fail outcome of the check, which is what Didit returns to us

See section 7, which explains this in full.

Prize claim data. The information needed to get a prize to you, including your name and email address, and the details of the claim itself.

Location data. The city you are based in. We ask every winner for this when they claim a prize, and we ask nobody else for it. We use it for the winner announcement described at section 8, and it is what allows us to meet the Advertising Standards Authority disclosure described in that same section if a draw is challenged. That second duty applies even where you have asked us not to be named, which is why we ask every winner. We ask for a city, never an address.

Business enquiry data. If you contact us on behalf of a business: your name, email address, phone number and the content of your message.

Correspondence data. The content of emails, support requests and social media messages between you and us.

Technical data. Your device and browser type, your IP address, and page performance information. We do not use advertising trackers or session recording.

Age data. Your date of birth, and your confirmation that you are 18 or over. You give us your date of birth when you create your account, and if it shows that you are under 18 you cannot create one. We do not verify it at that point — it is a declaration by you. If you win a prize, your date of birth is also read from your identity document during the verification described in section 7.

6.Why we use your personal data, and our lawful basis

Under UK GDPR we must have a lawful basis for everything we do with your personal data. The table below sets out each purpose and the basis we rely on. Some activities rely on more than one basis.

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights and interests. You can ask us for the details of that assessment, and you can object to processing based on legitimate interests. See section 18.

7.Identity and age verification

Local Draws is for people aged 18 and over only.

When you sign up, you give us your date of birth and confirm that you are 18 or over. If the date of birth you enter shows you are under 18, you cannot create an account. Beyond that, it is a declaration by you and we do not verify it at that point.

When you win a prize, we verify your identity and age before the prize is released. This check is carried out for us by Didit Identity Spain, S.L., an identity verification provider. Didit asks you to submit an identity document, take a selfie, and complete a short liveness step that confirms a real person is present rather than a photograph or a recording. It then returns a pass or fail result to us.

We use Didit for document verification, face matching and liveness only. We do not use it to estimate your age from your face, and we do not screen you against sanctions, criminal or politically exposed persons lists.

What this means for your data. The facial verification step involves biometric data. Under UK GDPR, biometric data used to identify a person uniquely is "special category" data and has extra protection in law. We take this seriously.

• Didit carries out this check on our instructions, as our processor, under a signed data processing agreement. We remain responsible for it.
• Local Draws never receives or stores your identity document, your selfie or your facial measurements. We receive and keep only the pass or fail outcome and a short note of the decision.
• Didit holds the underlying documents and images for 30 days, which is the retention period we have set, and then deletes them.
• Didit's processing infrastructure is in the European Economic Area.
• A person at Local Draws reviews every failed check before any decision is made about your prize. No prize is withheld by an automated system alone. See section 15.

Your verification data is not used to train anything. Didit's standard terms would otherwise allow it to use information derived from verifications to improve its own fraud detection systems. We have opted out of that on behalf of everyone who verifies with us. Your identity and biometric data is used to check that you are who you say you are, and for nothing else.

Your explicit consent. Before the check begins, and before any of your information reaches Didit, we ask you to tick a box confirming that you agree to it. That tick box is separate from accepting our terms, it is never ticked for you, and it explains exactly what the check involves. We keep a record of your agreement.

You can withdraw your agreement at any time by emailing hello@localdraws.com. Without the check we cannot confirm you are eligible, so we would not be able to release a prize to you, but withdrawing does not affect anything else about your account.

If you are under 18. If we discover at any point that someone using Local Draws is under 18, we will void their entries, refund any payment they made, and delete their account and personal data apart from the entry and payment records we are legally required to keep, which we restrict so they are used only for that legal purpose. If the person was drawn as a winner, we will redraw that prize. See section 16.

8.Announcing winners

When someone wins a draw, we publish the result. This is a disclosure of personal data, so we want to be clear about it.

What we publish. Your first name and your city only. For example, "Sarah, Manchester". We do not publish your surname, your full address, your email address, your phone number or a photograph of you.

When we publish it. Once you have claimed your prize and passed the identity check, and never before.

Where we publish it. On the Local Draws website, and on Local Draws social media accounts.

Prize Partner channels. Where a prize was provided by a Prize Partner, that partner may want to publicise the winner on their own website or social media. We will not agree to that without asking you first and getting your agreement. Where we bought the prize ourselves this does not arise, because the business the prize is used at is never told who won.

Why we do it. Publishing winners is how we show that our draws are real, that prizes are actually awarded, and that the process is fair. We rely on our legitimate interests for this, and we keep the disclosure to the minimum that achieves it.

You can tell us not to name you. We publish your first name and city as a matter of course, so if you would rather we did not, email hello@localdraws.com. You can tell us before you claim or at any time after, and if it is already up we take it down. We then publish the result without identifying you, for example "Anonymous, Manchester". This is your right to object to processing we carry out on the basis of our legitimate interests, and you do not have to give us a reason. Objecting does not affect your prize in any way. You still receive it in full. An objection covers that draw, so if you win again and feel the same way, tell us again.

One disclosure declining cannot stop. The UK advertising rules require us to be able to show that our draws are run properly. If a draw is challenged, we may have to give the Advertising Standards Authority the surname and county of a major prizewinner, even where that winner asked us not to publish anything. That is a disclosure to a regulator that has asked, not a publication — we will not put it on the website, and we will tell you if it ever happens to you. The Draw Rules set this out at section 15, before you enter.

Removal later. Winner announcements stay published so that there is a lasting record of the draw. If you later want your name removed, contact us and we will remove it.

9.Sharing your data to fulfil a prize

How we get a prize to you depends on where that prize came from, and the draw page tells you which it is before you enter.

Where we bought the prize ourselves, we share nothing with anybody. We send you the voucher, the code or the booking details directly. The business the prize is used at is never told your name, your email address, or anything else about you, and it is not told that a prize draw was involved at all. Fulfilling a prize we bought involves no disclosure of your personal data to anyone.

Where a business provided the prize as a Prize Partner, the rest of this section applies to you. Where we bought the prize, none of it does.

Where a Prize Partner provided the prize

Some prizes are provided by businesses we work with, which we call Prize Partners.

What we share. After you have claimed a prize, and only then, we share your full name and email address with the Prize Partner for that draw.

When we share it. Only after a claim, and only with the partner for the draw you actually won. Prize Partners never see the details of people who entered and did not win.

Why we share it. Two reasons. So the partner can arrange your prize with you directly if required, for example booking a table or arranging a stay. And so the partner can check that the person turning up to use the prize is the person entitled to use it. Prizes are personal to the winner — they cannot be sold or passed to somebody else, though the Draw Rules explain at section 14 that we may occasionally agree to let somebody else use a prize in the winner's place. If your details do not match at the venue, the partner contacts us rather than turning you away.

Anything beyond those two fields. Some prizes may not be arrangeable on a name and an email alone. If that ever applies, we agree in writing with the partner beforehand what else is needed and why, we send no more than the prize actually requires, and we tell you before we send it. This applies only where a Prize Partner is fulfilling the prize.

If we agree to let somebody else use a prize. Where a winner cannot use a prize, the Draw Rules at section 14 say we will do what we reasonably can, which in some cases means agreeing to let somebody else use it in the winner's place. That is a decision we make case by case, not a right. If we do agree, we pass that person's name, and an email address if the partner needs one, to the Prize Partner for that draw — nothing more. Everything in this section then applies to that person's details exactly as it applies to a winner's: the partner may use them only to fulfil the prize, must contact us rather than turn anyone away if something does not match, and must delete them afterwards. If you are that person, this section is how your data is handled, even though you never entered a draw.

What the Prize Partner is, in legal terms. Once we pass your details to a Prize Partner, that business decides for itself how it handles them, so it becomes an independent data controller of your information rather than someone acting on our instructions. In practice this means the Prize Partner is responsible in its own right for what it does with your details, and it must have its own lawful basis for doing so. If you want to know what a particular Prize Partner does with your data, or you want them to erase it, you can contact them directly, and we will help you do so if you ask. We require every Prize Partner to sign a data sharing agreement with us before we pass them any winner's details. It limits them to using those details to fulfil your prize, and requires them to delete the details afterwards.

10.Who else we share your data with

We use a small number of carefully chosen companies to help us run Local Draws. Except for DNA Payments, all of them act as our processors, which means they act only on our instructions and cannot use your data for their own purposes.

About DNA Payments. DNA Payments Limited processes your card payment. Your full card details go directly to them and Local Draws never sees or stores them. Because DNA Payments has its own legal duties under payment regulation and anti money laundering law, it decides for itself how it handles card data, and so it acts as an independent controller rather than as our processor. Their own privacy notice explains what they do with it.

We may also share your personal data:

• with our professional advisers, such as accountants and lawyers, where necessary
• with law enforcement, regulators or courts, where we are required to by law
• with a buyer or prospective buyer, if we ever sell the business, in which case your data would pass to the new owner and you would be told

We do not sell your personal data. We do not share it with third parties for them to market their own products to you.

11.Where your data is held, and international transfers

Some of the companies we work with are based outside the United Kingdom, or are owned by companies that are. Where personal data leaves the UK, the law requires us to make sure it stays protected.

In plain terms: the two places your entry and payment records actually live, Neon and DNA Payments, are both in the UK. The providers based in the United States are covered either by a framework the UK Government has recognised as providing adequate protection, or by the standard contract terms UK law approves for this purpose, or both.

If you would like more detail about the safeguards for a particular provider, please ask us.

12.How long we keep your data

We keep personal data only as long as we need it.

Please note: if you ask us to erase your data, we will do so wherever we can, but we cannot delete entry and payment records before the end of the 6 year period because we are legally required to keep them. In that case we will restrict them so that they are used only for that legal purpose.

13.Marketing and emails

Emails we send you because you are using the service. When you enter a draw we send you confirmations, results and information about your prize. These are not marketing and you cannot opt out of them while you have an active entry or claim, because we need them to run the draw for you.

Notify lists. If you register interest in a city that has not launched, we use your email address to tell you when that city goes live. That is all we use it for. If we later want to send you anything else, we will ask you separately and you are free to say no.

Marketing to people who have entered a paid draw. If you have bought an entry, we may email you about future Local Draws draws, which are similar to what you already bought. This relies on the soft opt-in rule in PECR regulation 22. You can refuse this when you enter, and you can unsubscribe from any email we send. We will stop straight away.

Marketing to everyone else. If you have not bought an entry, including if you entered by the free postal route, we will only send you marketing if you have given us your consent.

How to stop marketing. Use the unsubscribe link in any marketing email, or email hello@localdraws.com. There is no charge and we will action it promptly.

We do not send marketing by text message or phone, and we have no plans to. If that changes, we will ask for your consent first.

14.Cookies and similar technologies

Our website uses a small number of cookies that are strictly necessary to sign you in and keep your session secure. We do not use advertising cookies, tracking cookies, session recording, or tools that profile you or follow you between websites.

We do monitor errors and page speed. We use Sentry to tell us when a page breaks, and on a small sample of visits how long pages take to load. It stores nothing on your device. Section 10 explains its role and section 11 explains where the data is held.

Full details are in our Cookie Policy.

15.Automated decision making

Winner selection is automated. Winners are selected at random by our system from the eligible entries in a draw. There is no profiling involved, no assessment of you as a person, and no characteristic of yours makes you more or less likely to be selected. Every eligible entry has the same chance. Because the selection is random rather than an evaluation of you, we do not consider that this engages your rights under Article 22 of the UK GDPR, which concerns decisions made about you based on your personal characteristics.

Identity verification is not fully automated. Didit performs an automated check, but a person at Local Draws reviews every failed result before any decision is taken about a prize. This means no decision affecting your prize is made by automated means alone. If your check fails, we will tell you, a person will look at it, and you can give us your side of it.

We do not carry out any other automated decision making or profiling that produces legal effects for you or similarly significantly affects you.

16.Children and people under 18

Local Draws is for people aged 18 and over. It is not intended for children and we do not knowingly collect personal data from anyone under 18.

You confirm your age when you create an account, and we verify identity and age before releasing any prize.

If we find out that someone under 18 has created an account or entered a draw, we will:

• void their entries
• refund any payment they made
• delete their account and their personal data, apart from the entry and payment records we are legally required to keep, which we restrict so they are used only for that legal purpose
• redraw the prize, if they had been selected as a winner

If you believe a child has given us their personal data, please contact us at hello@localdraws.com and we will delete it.

17.Security

We take appropriate technical and organisational measures to protect your personal data, including:

• your card details never reach our systems, and are handled directly by DNA Payments, who are PCI DSS compliant
• identity documents, selfies and facial measurements are never stored on our systems, and are held by Didit for 30 days only. Didit holds ISO/IEC 27001:2022 certification, a SOC 2 Type 1 attestation and iBeta Level 1 presentation attack detection testing under ISO/IEC 30107-3
• passwords and login credentials are managed by Clerk and are not visible to us
• our database is hosted in the UK and access to it is restricted to those who need it
• data is encrypted in transit
• access to personal data is limited to people who need it to do their job

No system can be completely secure, and sending information over the internet always carries some risk. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and we will tell you directly where the law requires us to.

18.Your rights

Under UK GDPR you have the following rights:

• Access. To be given a copy of the personal data we hold about you
• Rectification. To have inaccurate data corrected
• Erasure. To have your data deleted, in certain circumstances
• Restriction. To have us stop using your data while something is resolved, in certain circumstances
• Objection. To object to processing we carry out on the basis of legitimate interests, and to object to direct marketing at any time
• Portability. To receive data you gave us in a machine readable format, in certain circumstances
• Withdrawal of consent. Where we rely on your consent, to withdraw it at any time. This does not affect anything we did before you withdrew it

How to exercise them. Email hello@localdraws.com or write to Data Protection, Local Draws Limited, 70 Marsland Road, Sale, M33 3HG. Tell us which right you want to use and what data it concerns. We may ask you for information to confirm who you are.

How long it takes. We respond within one month. If your request is complex or you have made several, we may extend this by up to two further months, and we will tell you within the first month if we do.

Cost. Exercising your rights is free. We will only charge a fee, or refuse a request, if it is manifestly unfounded or excessive, which is what the law allows. If we refuse we will explain why and tell you how to complain.

Requests we cannot fully meet. Some rights have limits. In particular, we cannot delete entry and payment records inside the 6 year period we are legally required to keep them for, and we cannot delete data we need to defend a legal claim. Where that applies we will explain it and delete everything else we can.

We handle rights requests manually. There is no self service privacy area in your account.

19.Complaints

If you are unhappy with how we have handled your personal data, please tell us first at hello@localdraws.com. We would like the chance to put it right.

You also have the right to complain to the Information Commissioner's Office, which is the UK supervisory authority for data protection:

• Website: https://ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

You do not have to complain to us first, though we would appreciate it.

20.Links to other websites

Our website and our emails may link to websites run by other people, including Prize Partners. We are not responsible for how those websites handle your personal data. Please read their own privacy policies.

21.Changes to this policy

We may update this policy from time to time. When we do, we will publish the updated version on this page and change the version number and effective date at the top.

Please check this page from time to time so you know what the current version says.

22.Contact us

For anything to do with this policy or your personal data:

Local Draws Limited

Data Protection, 70 Marsland Road, Sale, M33 3HG

hello@localdraws.com