Privacy Policy

Last updated: 11 September 2026

1. Who we are

PoolDraw ("we", "us", "our") is a web application that helps groups organise lottery ticket-buying syndicates. We provide tools for tracking contributions, logging ticket numbers, and calculating winnings splits. We do not operate a lottery, accept stakes, or hold winnings on your behalf.

We are registered as a data controller with the Information Commissioner's Office (ICO) [registration number to be inserted]. For any data-related queries, contact us at: [your contact email]

2. What data we collect and why

Account data — when you create an account, we collect your name and email address. Legal basis: performance of a contract (providing the service you've signed up to).

Pool and contribution records — we store records of which members have paid into each draw, the amounts, and the dates. Legal basis: performance of a contract; legitimate interest in maintaining an accurate audit trail for all syndicate members.

Ticket numbers — when a syndicate organiser logs ticket entries, we store the numbers associated with each draw. Legal basis: performance of a contract.

Ticket photos (optional) — if you choose to upload a photo of a physical ticket as a backup, we store that image. Legal basis: your consent, given at the point of upload. You may delete uploaded photos at any time.

Usage data — we collect standard server logs (IP address, browser type, pages visited, timestamps) for security monitoring and service improvement. Legal basis: legitimate interest.

3. Member data and syndicate organisers

When a syndicate organiser invites members to a pool, those members' names and email addresses are stored in PoolDraw. Organisers are responsible for:

• Ensuring members know their data is held on PoolDraw
• Having a legitimate reason to add members (e.g. an existing workplace arrangement)
• Not adding people to a pool without their knowledge or agreement

We act as a data processor in relation to the personal data of members added by organisers. Organisers act as data controllers for their syndicate members' data.

4. How long we keep your data

• Active accounts: for as long as your account is active
• Draw and contribution records: 3 years from the date of the draw (to support any disputes or queries about past winnings)
• Ticket photos: until you delete them, or 12 months after the associated draw, whichever is sooner
• Closed accounts: we delete personal data within 30 days of account closure; contribution records are anonymised and retained for 3 years

5. Who we share your data with

We do not sell your personal data. We share data only where necessary to provide the service:

• Cloud infrastructure: your data is stored on secure servers in the UK/EEA
• Payment processors: if you pay for a PoolDraw subscription, payment is handled by Stripe (Stripe, Inc.). We do not store your payment card details. Stripe's privacy policy is at stripe.com/gb/privacy
• Email delivery: we use a third-party service to send transactional emails (draw reminders, account confirmations). These providers process email addresses only as necessary to deliver messages

We may disclose data to law enforcement or regulatory authorities where required by law.

6. Your rights under UK GDPR

You have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct inaccurate data
• Erasure — ask us to delete your data (subject to our retention obligations)
• Portability — receive your data in a machine-readable format
• Restriction — ask us to limit how we use your data while a dispute is resolved
• Objection — object to processing based on legitimate interest
• Withdraw consent — where processing is based on consent (e.g. ticket photos), withdraw it at any time without affecting past processing

To exercise any of these rights, email us at [your contact email]. We will respond within one month.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk/make-a-complaint.

7. Cookies

PoolDraw uses only essential cookies necessary for the service to function (session authentication). We do not use tracking or advertising cookies. No cookie consent banner is required for essential cookies only.

8. Security

We use industry-standard security measures including encrypted connections (HTTPS), access controls, and regular security reviews. No system is completely secure; in the event of a data breach that is likely to affect your rights and freedoms, we will notify the ICO within 72 hours and inform affected users without undue delay.

9. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify registered users by email at least 14 days before the change takes effect. The "last updated" date at the top of this page reflects the most recent revision.

10. Contact

For any questions about this privacy policy or your personal data:

• Email: [your contact email]
• ICO registration: [ICO registration number]