Privacy Policy
Privacy Policy
Last updated: 9 July 2026
This Privacy Policy explains how GFNI Ltd, trading as RaffleX, handles personal data. It applies to this website (rafflex.io) and to the RaffleX platform we provide to competition operators.
1. Who we are
RaffleX is the trading name of GFNI Ltd, a company registered in Northern Ireland (company number NI677326).
- Registered office: Office 13, Space Antrim, 55-59 High Street, Antrim, County Antrim, BT41 4AY
- Contact: support@rafflex.io, +44 7587 437180
GFNI Ltd is the data controller for the personal data described in this policy, except where we act as a processor (see section 3).
2. Scope of this policy
This policy covers personal data relating to:
- visitors to rafflex.io
- competition operators who hold an account with us, and their staff
- people who contact us or subscribe to our updates
3. Our two roles
RaffleX operates at two levels, and our role differs depending on whose data it is.
We are a controller for the personal data of our own website visitors, account holders (operators) and people who contact us. This policy covers that data.
We are a processor for the personal data of people who enter competitions on sites run by our operators. In that case, the operator running the competition is the data controller and decides how that data is used. If you entered a competition on a site "Powered by RaffleX", please refer to that operator's own privacy notice for information about how your data is handled. We process that data on the operator's instructions, and our handling of it is governed by our Data Processing Agreement with the operator.
4. What we collect and why
| Personal data | Purpose | Lawful basis |
|---|---|---|
| Name, business email, phone, account details | Create and manage operator accounts and provide the platform | Contract |
| Billing details and payment tokens | Charge subscription and transaction fees | Contract; legal obligation (tax records) |
| Support messages and history | Respond to your queries | Contract; legitimate interests |
| Marketing preferences | Send you updates about RaffleX where you have opted in or not opted out | Consent, or legitimate interests |
| IP address, device and browser data, cookie data | Keep the site secure, prevent fraud and abuse, and understand and improve the site | Legitimate interests; consent for non-essential cookies |
We do not seek or require special category data (such as health data). Please do not send us special category data through free-text fields.
5. Cookies
We use cookies and similar technologies on rafflex.io. For details of what we use and how to manage them, see our Cookie Policy.
6. Who we share data with
We use trusted service providers (sub-processors) to help run the platform, including cloud hosting, content delivery and security, subscription billing, and customer support. The current list, including where each provider processes data and the safeguards in place, is on our Sub-Processors page. For our own marketing emails, we use Brevo (Sendinblue SAS), based in France.
We do not sell personal data. We may disclose personal data where required by law, or to establish, exercise or defend legal claims.
7. International transfers
We host personal data in the United Kingdom and the European Economic Area (EEA). Transfers from the UK to the EEA are covered by the UK's adequacy regulations. Where a provider processes data outside the UK and EEA, we rely on an appropriate safeguard, such as the UK's data-bridge regulations, the ICO's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Details per provider are on our Sub-Processors page.
8. How long we keep data
We keep personal data only as long as we need it.
- Operator account data: for the life of the account and for a limited period afterwards
- Financial and transaction records: 6 years, to meet HMRC and Companies Act requirements
- Marketing data: until you opt out; we keep a suppression record so we can honour your opt-out
- Support records: 36 months after your last contact
For personal data we process on behalf of operators, retention is set by the operator, subject to our platform defaults. On termination of an operator's account, their data and backups are deleted after the export window set out in our terms, with no copies kept, save where we must keep certain records by law.
9. Your rights
You have rights over your personal data under UK data protection law, including the right to:
- access a copy of your data
- have inaccurate data corrected
- have your data erased in certain circumstances
- restrict or object to certain processing
- data portability
- withdraw consent at any time where we rely on consent
To exercise any of these rights, contact us at support@rafflex.io. If your data was collected by a competition operator (see section 3), please contact that operator, as they are the controller for that data.
10. Complaints
If you have a concern about how we handle your personal data, please contact us first at support@rafflex.io. We will acknowledge your complaint within 30 days and respond as soon as we can.
You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, or by calling 0303 123 1113.
11. Children
The RaffleX platform is intended for adults (18 or over). We do not knowingly collect personal data from children through rafflex.io.
12. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. Significant changes will be highlighted on this page.
13. Contact
For any privacy question, contact us at support@rafflex.io.