1. Who operates the website?
SlabRaffle is the name used by this independent collector website at www.slabraffle.com. Email info@slabraffle.com with the subject “Privacy request” for access, correction, deletion, objections or other questions about your data. The complete legal identity and physical address of the data controller must be supplied before launch of paid competitions. We do not claim that a Data Protection Officer has been appointed.
2. What data we collect
Depending on how you use SlabRaffle, this can include: account ID, email address, email-verification and authentication state, profile display name and optional saved contact name; preferences about how a name would appear in public draw records; questions answered, entry quantities, order and ticket numbers, payment status and competition activity; information you include in support emails and moderated community posts or comments; and technical logs needed for security and service delivery. If a free postal-entry process is activated after legal review, information received with those submissions will also be processed for verification and fulfilment.
When you use Stripe-hosted checkout in the authorised test environment, payment card information is provided to Stripe, not stored as a card number or security code in SlabRaffle's user profiles. SlabRaffle stores limited order and payment-reference information to reconcile transactions. Live payment processing is not currently enabled.
3. Why we process data and the relevant legal bases
Accounts and requested features: identification, sign-in and account preferences are needed to provide the account service you request (ordinarily contract or pre-contract steps). Security and abuse prevention: access logs, suspected misuse, fraud checks and moderation help protect users and the platform (ordinarily legitimate interests, subject to balancing, or legal obligations). Competition administration: if authorised later, entry records, eligibility, reconciliation, winner confirmation and prize delivery are necessary to administer the competition contract and applicable obligations. Legal and accounting records: records may be needed to comply with tax, financial and regulatory requirements. Support correspondence: the information you send is used to answer and resolve your enquiry. Optional analytics and advertising: consent is requested before relevant tracking is enabled. The operator must document each final legal basis and any legitimate-interest assessment before paid launch.
4. Public draw names and transparency
The website is designed to show an entrant, before a paid checkout, the draw name associated with each confirmed entry number. By default it is the first name and surname initial; choosing a full contact name is optional. The public CSV associated with a recorded draw may show entry numbers, selected public names and entry routes, and may be visible in a recording. Email addresses, postal addresses and card details are excluded. Earlier entries created before the disclosure are not publicly identified retrospectively.
Even abbreviated names can identify people. The operator must establish a lawful basis, explain recording/publication and retention, provide equivalent advance notice to postal entrants, and determine the response to privacy objections before any real-name draw is held. A checkbox acknowledging the notice is not, by itself, proof of a valid GDPR lawful basis.
5. Community, guides and events
Published community posts and comments may be visible to other visitors along with the display name selected by their author. Submissions are reviewed before appearing publicly. Do not publish personal contact information, addresses or other details you are not entitled to disclose. Guides and event listings normally contain public editorial and organiser information.
6. Who may receive your information?
We use service providers as needed to operate the website. These include Supabase for authentication, database and storage, Vercel for hosting and application delivery, Cloudflare for DNS and inbound email forwarding, Resend for configured transactional email delivery, Stripe for test-mode payment processing and, only if you opt in to the corresponding purpose and the service is configured, Google Analytics, Google Ads and Meta Pixel. Service-provider access must be limited to what is required. We may disclose data where a valid legal obligation applies or to respond to lawful claims.
Cloudflare forwards email addressed to info@slabraffle.com to the operator's monitored inbox. Your message may therefore be processed by the forwarding provider and that destination mailbox provider. The operator must verify processor agreements, actual host locations, and transfer safeguards for services that handle data outside the EEA.
7. International transfers
Some providers may process information outside Ireland or the European Economic Area. Where GDPR transfer restrictions apply, an appropriate mechanism such as an adequacy decision or standard contractual clauses, together with any necessary additional safeguards, must be assessed and documented. The precise transfer arrangements should be confirmed from the operator's live provider contracts before paid launch.
8. Retention and security
Account information is retained while needed to maintain an account and meet lawful obligations. Support messages are retained for responding to enquiries and handling disputes. Competition entry and transaction records may require longer retention for audit, accounting, claims and legal compliance. Community content can remain visible until removed under moderation or applicable rights. Consent choices stored locally are designed to expire after around 180 days. The operator must approve concrete retention periods and deletion routines for each record category before live paid operation.
We use account authentication, restricted administrative access, moderated public submissions and other technical controls. No internet service can promise absolute security. If you believe your account is compromised, contact info@slabraffle.com promptly.
9. Your data protection rights
Subject to the applicable law and circumstances, you may have rights to access your personal data, request correction or erasure, restrict processing, object to certain processing, receive portable data and withdraw consent where consent is the legal basis. We may ask for proportionate identity verification before disclosing private account records. Contact info@slabraffle.com with “Privacy request” in the subject. You can also complain to the Irish Data Protection Commission if you are dissatisfied with our handling of your rights.
10. Cookies, marketing and consent
Necessary browser storage supports sign-in and remembering your privacy choices. Optional Google Analytics, Google Ads and Meta Pixel are controlled through separate analytics and advertising selections. You can reject optional tracking or change your preferences using Cookie settings in the footer. We do not intentionally send account emails, private contact names, ticket numbers or payment card details to marketing pixels. Read our Cookie Policy for the categories and examples.
11. Children, decisions and updates
The website is intended for an adult collecting audience; the legal entry age and jurisdictions will be confirmed before competitions open. The platform does not currently use automated decisions to award live paid competition prizes. The operator should update this notice when data handling, final policies or suppliers change and identify the effective date when full operator particulars are available.
12. Questions
For all privacy requests and support concerns, contact info@slabraffle.com. Please do not include passwords or full payment-card details in email.