Who we are
[not set] ("ORVETTA", "we", "us"), registered office [not set], is the controller of the personal data described in this notice. Contact us about your data at help@orvetta.com.
What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account | name, email address, password (stored only as a one-way hash), date of birth, phone number, addresses | you |
| Entries and orders | entry numbers, orders, amounts, payment status, refunds, chargebacks | you and our payment provider |
| Payment details | card type, last four digits, whether it is a credit or debit card, issuing country | our payment provider. We never see or store your full card number. |
| Free entries | your letter or postcard, a scan of it, the date it arrived | you |
| Age and identity checks | the result of each check and its reference | you and our age verification provider |
| Responsible participation | spending limits, breaks, suspensions, closures, and notes from our team | you and us |
| Winners | verification documents, prize delivery details, and the publicity choices you make | you |
| Support and complaints | your messages and our replies | you |
| Prize submissions | contact details, item details, photos and documents | you |
| Technical | IP address, browser type, a device identifier, sign-in history, security logs | your device |
Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Run your account, take payment, issue entries, run draws, award prizes | Contract |
| Check age and eligibility, keep financial records, respond to regulators and the police | Legal obligation, and legitimate interests in running fair draws |
| Responsible participation tools and checks for people at risk of harm | Legitimate interests in protecting customers |
| Fraud prevention and security | Legitimate interests in protecting customers and ORVETTA |
| Publishing a winner's name, region, photo, video or comments | Consent, given separately for each item. You can withdraw it at any time. |
| Marketing emails and notifications | Consent. We never turn this on for you. |
| Prize submissions | Legitimate interests in sourcing prizes |
Automated checks
We use automated checks to spot fraud and people who may be at risk of harm, for example many failed payments or a spending limit reached again and again. A check can hold an order for a member of our team to review. Checks never affect whether you win. You can ask a person to review any decision about your account.
Who we share it with
- Our payment provider, to take and refund payments and to handle chargebacks.
- Our age verification provider, when a check is needed.
- Our email, hosting and security providers, including Cloudflare, who protect and deliver the website.
- Professional advisers, such as lawyers and accountants.
- The police, regulators and courts, when the law requires it.
- Prize suppliers and delivery companies, to deliver a prize to a winner.
We never sell your personal data.
Some providers process data outside the UK. When they do, we rely on UK adequacy regulations or on the ICO's International Data Transfer Agreement or Addendum.
How long we keep it
| Data | Period |
|---|---|
| Account | while your account is open, then 6 years |
| Orders, payments and refunds | 6 years after the end of the financial year they relate to |
| Entries and draw records | 6 years. The public pool file lists only entry numbers and random references and stays published. |
| Free entry letters | scans for 6 years with the draw records. Paper originals are destroyed 3 months after the draw. |
| Breaks, suspensions and closures | for as long as they are in force, then 6 years |
| Support messages and complaints | 3 years after they are closed |
| Prize submissions we do not take forward | 12 months |
| Technical and security logs | 12 months, except records of staff actions, which we keep for 6 years |
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, object to how we use it, or send it to another organisation. Some rights apply only in some situations. Email help@orvetta.com. We reply within one month.
You can complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113. Please contact us first so we can try to help.
Age
ORVETTA is for adults only. We do not knowingly collect data about anyone under 18. If we find that an account belongs to someone under 18, we close it and refund any open entries.
Changes
We publish each new version of this notice with its date. Earlier versions are available on request.