Data protection (GDPR)

• Participant's email — solely to confirm their entry (double opt-in) and, if they win, to notify them. It is never resold or used for any other purpose.
• IP / device fingerprint — used for fraud prevention (preventing multiple entries). These are fingerprints, not cleartext IPs, and they are never linked to an identity.
• Country of connection, derived from the IP address — only when a giveaway limits the countries its prizes can be delivered to, and only to warn you before you take part. The lookup happens in memory, against a database embedded on our servers: your IP address is sent to no one, and the resulting country is neither recorded nor kept. It excludes no one: you remain free to enter, and your entry counts like any other. The destination of a prize is only checked when you claim it, against the address you provide yourself.
• Creator account (name, email) — to manage the workspace and billing. Participants never pay: no participant money flow, therefore no participant banking data.

Each customer (organizer) is isolated from the others: their participants' data is accessible only to them, never to another customer nor to the platform console, which only sees anonymized aggregates. The isolation is structural (schema per tenant + Row-Level Security in the database).

An entry is valid only after email confirmation: the participant consents explicitly, and an unconfirmed entry does not enter the draw.

Participation data is kept for the duration of the giveaway and its verifiability, then purged. Purposes and durations are declared; no "just in case" retention.

Your data is never sold, rented or passed on to third parties for advertising purposes. It is entrusted to a deliberately small number of processors, each for a specific purpose:

• OVH SAS, established in France — hosting of the servers, the database and media storage (draw videos, supporting documents), in data centres located within the European Union.
• Stripe Payments Europe, Ltd. (Ireland, European Union) — processing of organisers' subscription payments. Never involved in an entrant's journey.
• Mailjet (France, European Union) — delivery of transactional email: double opt-in entry confirmation, winner announcement, account notifications.

Each is bound by a processing agreement within the meaning of article 28 GDPR. No data is transferred outside the European Union.

The drand network, the public randomness source of the draw, receives no data: it is queried read-only.

Access, rectification, erasure, objection: a participant can exercise their rights with the giveaway's organizer (data controller) or with DrawSeal. The public proof of a draw never exposes an email: it uses only recomputable pseudonymous identifiers.

A participant can also exercise them themselves, without asking anyone, from the Your participation data page: viewing, erasure and unsubscribing are self-service there.

If you consider that the processing of your data does not comply with the GDPR, you may lodge a complaint with the competent supervisory authority, without prejudice to any other administrative or judicial remedy:

Data Protection Authority
Rue de la Presse 35, 1000 Brussels, Belgium
dataprotectionauthority.be

You may also contact the supervisory authority of your Member State of residence.