Privacy Policy

RaffleProp Ltd, 36 Minfa Crescent, Karu, Nasarawa, Nigeria (RC9484205) is the Data Controller for all personal data collected through this platform. Our Data Protection Officer can be reached at privacy@raffleprop.com.

We collect the following categories of personal data:

• Identity: full name, date of birth
• Contact: email address, phone number
• Government ID: BVN (encrypted), NIN (encrypted)
• Technical: IP address, device, browser, OS
• Transaction: ticket history, payment references
• Usage: pages visited, campaign interactions

We never collect or store raw card numbers. All card payments are processed directly on Paystack or Flutterwave's PCI-DSS compliant hosted pages.

We use your personal data for the following purposes:

• Process ticket purchases and issue FCCPA §118 receipts
• Verify your identity when you win (BVN + NIN matching)
• Send campaign receipts, draw notifications, and account alerts
• Send marketing communications (with your consent only)
• Comply with AML/KYC obligations under SCUML regulations
• Respond to NDPR data subject requests
• Detect and prevent fraud and multiple accounts
• Report draw results to the FCCPC per FCCPA §124

Under the NDPR 2019, we process your data on the following lawful bases:

BVN and NIN data are encrypted at rest using AES-256-GCM before storage. Decryption occurs only during KYC verification for winner identity confirmation. These fields are never logged, displayed, or transmitted in plain text. Encryption keys are stored separately from the encrypted data and are rotated periodically.

We share your data only where strictly necessary:

We never sell, rent, or trade your personal data to any third party for commercial purposes.

Some of our service providers — including Paystack, Flutterwave, and our cloud infrastructure provider — may process personal data outside of Nigeria. Where such transfers occur, we ensure that appropriate safeguards are in place in accordance with NDPR Article 43, including:

• Contractual data processing agreements requiring the recipient to apply data protection standards equivalent to the NDPR
• Transfers only to processors who are certified or regulated under recognised data protection frameworks
• Transfers of the minimum data necessary for the specific processing purpose

Raw BVN and NIN data are never transmitted internationally. These fields are decrypted only within our Nigerian-hosted infrastructure during winner verification.

We apply the following technical and organisational security measures:

• All data in transit encrypted via TLS 1.3
• BVN/NIN encrypted at rest with AES-256-GCM
• Regulatory documents stored in WORM (write-once) storage
• Access to personal data restricted on a need-to-know basis
• Admin accounts require two-factor authentication (TOTP)
• No PII written to application logs in plain text
• All data access events recorded in an append-only audit log

In the event of a personal data breach that is likely to result in risk to the rights and freedoms of affected individuals, RaffleProp will:

Under the Nigeria Data Protection Regulation 2019, you have the following rights:

Exercise your rights at the NDPR / Data Rights page or by emailing privacy@raffleprop.com. We respond within 30 days as required by NDPR.

We retain personal data for the following periods:

We use only essential session cookies required for authentication and security. We do not use advertising, tracking, or analytics cookies. No third-party scripts (Google Analytics, Meta Pixel, etc.) are loaded without your explicit consent.

RaffleProp is intended for users aged 18 and over. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us at privacy@raffleprop.com and we will delete it promptly.

We may update this Privacy Policy from time to time. Where changes are material, we will notify registered users by email at least 7 days before the changes take effect. The date at the top of this page always reflects the most recent revision. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

For any privacy-related enquiries or to exercise your data rights, contact our Data Protection Officer at privacy@raffleprop.com.

If you are not satisfied with our response, you have the right to lodge a complaint with NITDA (National Information Technology Development Agency), the NDPR supervisory authority, at nitda.gov.ng.