Privacy policy

We only collect the data we need to run your account, process raffle entries and orders, draw and notify winners, and meet our legal duties. We never sell your data. Analytics cookies run only if you choose Accept on the cookie banner. You can contact us any time at support@packnpulls.com.

Pack'N'Pulls ("we", "us") operates packnpulls.com and is the "data controller" for the personal data described here.

Legal entity: Pack'N'Pulls Limited
Company number: 17403988
Registered address: 124 City Road, London, England, EC1V 2NX
Contact for privacy queries: support@packnpulls.com

Account and identity: your email address, chosen username, and date of birth (used only to confirm you are 18 or over).

Authentication: a securely hashed password (we never store it in readable form) and a signed sign-in session cookie.

Activity: raffle entries (paid and free-postal), order and payment status, site-credit balance and the daily-game plays that award it, and prize-claim and delivery details you give us if you win.

Support and messages: the contents of emails or contact-form messages you send us.

Technical: limited data your browser sends (e.g. IP address) used transiently to keep the service secure and rate-limited. We do not build advertising profiles.

Payments: card payments are processed by Stripe. We receive the outcome (paid, failed, refunded) and never see or store your full card number.

To provide the service you ask for: create your account, take entries, mint tickets, run the draw, award and spend site credit, and arrange prizes. Lawful basis: performance of a contract.

To verify you are eligible (18+, UK) and to run the prize draw fairly and keep records of it. Lawful basis: legal obligation and our legitimate interest in running a lawful, provably-fair promotion.

To keep the site secure: prevent fraud, abuse and repeated failed logins (rate limiting). Lawful basis: legitimate interests.

To send service messages you'd expect (order confirmations, winner notifications, and launch alerts for raffles you asked to be notified about). Lawful basis: contract or consent, depending on the message.

To understand how the site is used through analytics cookies. Lawful basis: your consent, which you give or withhold on the cookie banner and can change at any time.

We share data only with the service providers who help us run the site, each acting on our instructions under a contract, and only as far as needed:

Stripe: card payment processing.
Resend: sending transactional email.
Vercel: website hosting and image storage.
Neon: our managed database.
drand: a public randomness beacon used to make draws provably fair (no personal data is sent to it).
Google Analytics: usage analytics, only if you accept analytics cookies.
Sentry: error reporting, so we can find and fix faults. It receives technical details of the error only, not your account details.

We may also disclose data where the law requires it. We do not sell your personal data or share it for third-party advertising.

Some of the providers above process data outside the UK (for example in the EU or the United States). Where that happens, we rely on the UK's adequacy regulations or on the International Data Transfer Agreement / Standard Contractual Clauses so your data keeps an equivalent level of protection.

We keep your account data for as long as your account is open. If you close your account or ask us to delete it, we remove or anonymise your data unless we must keep certain records to meet legal obligations (for example, transaction and prize-draw records kept for accounting, tax and dispute-handling, typically up to six years). Notify-me sign-ups are kept until the raffle launches or you unsubscribe. Analytics data is retained per the settings in Google Analytics.

Under UK GDPR you have the right to: access a copy of your data; correct inaccurate data; erase data; restrict or object to certain processing; and data portability. Where we rely on consent (analytics cookies), you can withdraw it at any time without affecting past processing.

To exercise any of these, email support@packnpulls.com. We'll respond within one month. Some records tied to legal obligations (see above) may not be erasable while that obligation lasts. If you're unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.

Essential cookies keep you signed in and let the site work. Under the UK PECR rules these don't need consent, so they always run.

Analytics cookies (Google Analytics) help us understand how the site is used. These are optional: they load only after you click Accept on the cookie banner, and never if you click Reject. You can change your choice any time via the "Cookie settings" link in the footer.

We may update this policy from time to time. Material changes will be reflected here with an updated date, and where appropriate we'll let you know directly.