This Policy explains how Raflit, operated by Hkoorp Limited (RC 9657146), collects, uses, and protects your personal data when you use the Platform. It should be read together with our Terms & Conditions.
1. Data we collect
- Account data: your email address and chosen username.
- Identity (KYC) data: where verification is required, identity documents and details are processed by our verification partner (Didit); we receive a verification result and your phone number.
- Contact data: a phone number you provide (e.g. as a winner) so the other party can arrange handoff.
- Transaction data: wallet balance, top-ups, ticket purchases, payouts, and refunds. Card/bank details are handled by our payment partner (Nomba). Raflit does not store full card numbers.
- Content: listing photos and handoff photos you upload (stored via Cloudinary).
- Usage and device data: basic technical logs needed to operate and secure the service, and aggregate analytics (e.g. visit counts, approximate location, device/browser type) via Firebase Analytics.
- Support conversations: if you use the live chat, the messages you send and basic technical details about your session are processed by our chat provider (SendPulse) so we can answer you.
2. How we use your data
- To operate the marketplace: create accounts, run raffles and draws, hold escrow, and process payouts and refunds.
- To verify identity and prevent fraud, money laundering, and abuse.
- To connect a seller and a winner for delivery after a draw (limited contact sharing only).
- To send transactional notifications (wins, refunds, payouts, disputes) and important service messages.
- To understand overall usage of the Platform (e.g. how many people visit) via aggregate analytics.
- To meet legal, tax, and regulatory obligations.
3. When we share data
- Between transacting parties: after a draw, a seller and the winner see each other’s name and phone number solely to arrange handoff. Contact details are never shown in public listings.
- Winner celebration: if you upload a handoff photo as a winner, it may be shown publicly on the Platform to celebrate winners. You choose whether to upload it.
- Service providers: Google Firebase (authentication, database, hosting, analytics), SendPulse (delivery of sign-in and account emails, and the live chat widget), Nomba (payments and payouts), Didit (identity verification), Cloudinary (image hosting), and error-monitoring (Sentry). Each processes data only to provide their service.
- Legal: where required by law, regulation, or valid legal process.
4. Public information
Your username and your raffle listings are public. Winning usernames and, where you choose, a handoff photo may appear publicly. Your email, phone, identity documents, and payment details are never public.
5. Data retention
We keep personal data for as long as your account is active and as needed to provide the service, resolve disputes, and meet legal, accounting, and regulatory requirements (financial records may be retained for statutory periods). We then delete or anonymise it.
6. Security
Access to our systems is restricted and all database access runs server-side; the browser never accesses the database directly. Sign-in uses passwordless email links, and sessions are revocable. No system is perfectly secure, but we take reasonable measures to protect your data.
7. Your rights
Subject to applicable Nigerian data-protection law (including the NDPR/NDPA), you may request access to, correction of, or deletion of your personal data, and object to certain processing. Some data must be retained to meet legal obligations. To exercise these rights, contact us at privacy@raflit.app.
8. Children
Raflit is not for anyone under 18, and we do not knowingly collect their data.
9. Changes
We may update this Policy; material changes will be notified in-app. Continued use after an update means you accept the revised Policy.
10. Contact
Data-protection queries: privacy@raflit.app. Data controller: Hkoorp Limited (RC 9657146).