Privacy Policy

Raffila ("Raffila", "we", "us" or "our") is the Data Controller responsible for the personal information described in this Privacy Policy. Our processing is conducted in accordance with the Nigerian Data Protection Regulation 2019 ("NDPR") and applicable supplementary guidance issued by the Nigeria Data Protection Commission (NDPC).

We collect only the information reasonably necessary to operate the Services, lawfully run prize competitions, process payments, pay referral commissions, deliver prizes, meet our KYC, anti-money laundering ("AML"), and counter-financing-of-terrorism ("CFT") obligations and for the other purposes described in this Policy.

1. Account and registration data. When you create a Raffila account we collect your first name, last name, email address, Nigerian mobile phone number, chosen password (stored only as a cryptographic hash), date of birth, state of residence, and referral code (if any).
2. Verification, KYC and identity data. When you apply to withdraw referral commissions, claim a prize, or when we otherwise require enhanced verification, we collect your Bank Verification Number (BVN), a scan or photograph of a valid government-issued photo ID (PVC, NIN slip, Driver Licence, Passport), a selfie or liveness photo, proof of residential address not older than 3 months (utility bill, bank statement, rent receipt), and your Nigerian bank account details (bank name, account number, account name) for payout purposes.
3. Transaction, wallet and payment data. When you fund your Wallet, purchase competition entries, earn referral commissions, or request a payout, we collect transaction identifiers (including ticket IDs in the format RF-YYYY-XXXXXXXX), amounts, timestamps, payment processor references, the payment method used (card, bank transfer, USSD via Paystack or Flutterwave), last-4 of card numbers, and the status of each transaction. We do not store full card numbers or CVV — these are handled exclusively by our licensed PCI-DSS compliant payment Processors.
4. Competition and draw records. We retain a permanent record of every ticket purchased (ticket ID, draw ID, purchase timestamp, quantity, entry price paid, source account debited) together with the published HMAC_DRBG draw input and output for each competition you enter, in order to resolve disputes and for independent audit.
5. Device, location and technical data. We automatically collect IP address, approximate geo-location derived from IP (city/state level only), device make and model, operating system version, browser type and user agent string, screen resolution, referring URL, exit URL, pages visited, timestamps of visits, and general clickstream activity.
6. Marketing and communications preferences. We collect your opt-in consents, opt-out records, and email/SMS bounce/open/click metadata used to deliver lawful competition, referral and prize notifications and (only where consent is given) marketing communications.
7. Correspondence and support. We collect the content, attachments, and metadata of emails, support tickets, social media messages, chat transcripts, and telephone calls that you send to or receive from our support, legal, compliance, or anti-fraud teams.

We process each category of personal data only for one or more of the following purposes, relying on one or more of the lawful bases under the NDPR (contract performance, legitimate interests, legal obligation, consent, and protection of vital interests as applicable):

1. Contract performance. Creating and administering your Raffila account, verifying your identity so that prizes and referral commissions can lawfully be paid to you, issuing RF ticket identifiers, debiting your Wallet or Referral balance in exchange for entries, conducting draws, selecting winners, contacting winners, arranging prize delivery, and paying referral commissions to your bank account.
2. Legal obligation. Complying with the NDPR, CAMA, the CBN AML/CFT Regulations, the EFCC Act, tax reporting and withholding obligations, Nigerian sanctions law, valid court orders, subpoenas, lawful requests from Nigerian regulators, and our KYC and enhanced due diligence duties (including BVN verification and sanctions screening).
3. Legitimate interests. Operating and improving the Site and Services; preventing, detecting and investigating fraud, collusion, bot activity, ticket manipulation, VPN circumvention of geo-restrictions, money laundering, and other conduct which breaches the Terms and Conditions; enforcing our rights under our agreements; ensuring network and information security; conducting product analytics; sending required administrative and lifecycle notices (draw reminders, claim window alerts, account security alerts). Where we rely on legitimate interests, we conduct an internal balancing test and you may object as described in Section 6.
4. Consent. Where consent is required by applicable law — including for electronic direct marketing messages under the NDPR, the use of non-essential cookies, or the public release of a winner's full legal name and photographic likeness — we will only process after we have obtained your specific, freely given, informed, unambiguous, and revocable opt-in consent, which you may withdraw at any time.
5. Prize announcements and winners gallery. We publish first name, last initial and state of residence of verified winners in the public Winners Gallery (/winners) and across our marketing on the legitimate-interest basis described above, in order to evidence fair operation of the draws. A winner's full legal name, photo, and testimonial are published only with separate written consent.

We do not sell your personal information. We share data only with the categories of recipients listed below, always subject to appropriate safeguards (contractual data processing clauses, NDPR-compliant processor terms, confidentiality obligations, and technical and organizational security measures):

1. Payment processors. Paystack and Flutterwave, to process Wallet funding, payment authorisation, fraud screening, bank settlement and payouts. Payment processors operate under their own PCI-DSS certification and privacy notices.
2. Identity and KYC verification providers. Licensed Nigerian identity verification service providers and BVN verification endpoints to validate government IDs, proof of address, liveness, sanctions screening, and BVN match.
3. Prize partners and insurers. The partner that supplied a prize (where named on the competition page) and the prize-indemnity insurer(s), solely to the extent needed to deliver the prize, validate the insurance claim, or perform a required pre-delivery identity check on the winner.
4. Logistics and delivery partners. Licensed courier or logistics companies to deliver physical prizes to a winner's nominated Nigerian address; only the minimum data needed for last-mile delivery is shared (name, phone, delivery address, prize description).
5. Anti-fraud and cybersecurity vendors. Device fingerprinting, bot detection, and analytics providers to detect and prevent collusion, botnet entries, card testing, account takeover and account abuse.
6. Professional advisors. External auditors, solicitors, barristers, notaries public, accountants, tax advisors and insurers in the course of providing professional services to Raffila, bound by professional secrecy obligations.
7. Regulators and law enforcement. The Nigeria Data Protection Commission (NDPC), Central Bank of Nigeria (CBN), Economic and Financial Crimes Commission (EFCC), Independent Corrupt Practices Commission (ICPC), Nigerian Police Force, Federal Inland Revenue Service (FIRS), courts, and any other Nigerian regulator or competent law-enforcement body, in response to a valid, lawful, and specific written request, subpoena or court order.
8. Corporate transactions. In the event of a merger, acquisition, business combination, financing, reorganisation, or sale of all or substantially all of the assets of Raffila, your personal data may be transferred to the successor entity subject to the same or more protective privacy terms.

We maintain a publicly accessible Register of Data Processing Activities available on written request to privacy@raffila.com that describes, for each processing operation, the categories of data subject, personal data, processing purpose, lawful basis, recipient categories, retention periods, and applicable safeguards.

1. What cookies are. Cookies are small text files that a website stores on your browser or device. We use cookies and similar technologies (pixels, local storage, session storage) together with your explicit cookie preferences (managed via the Cookie Preferences banner) as required by the NDPR.
2. Strictly necessary cookies — always on. These cookies are required for basic operation of the Site and Services and include session authentication tokens, CSRF tokens, purchase-flow reservation timers (5-minute entry hold), load-balancer affinity identifiers, and cookie-consent choice persistence. These cannot be switched off because the Site would not function.
3. Analytics cookies (opt-in only). With your consent, we run privacy-preserving first-party product analytics to help us understand how visitors use the Site so we can improve it. We use aggregated, pseudonymised page-view and click-event data; no raw personal identifiers are exported out of Nigeria without your further consent.
4. Marketing cookies (opt-in only). With your explicit opt-in we may use social media remarketing pixels on Meta/Instagram and similar platforms to serve relevant Raffila advertisements to people who have visited the Site. These are deactivated unless you opt in.
5. Managing preferences. You can change your cookie preferences at any time by clicking "Cookie preferences" in the footer of the Site or by writing to privacy@raffila.com. Most browsers also enable you to block or delete cookies via browser settings; note that doing so may affect the functionality of the Services.

1. Retention by category. We retain personal data only for as long as reasonably necessary to fulfil the purpose for which it was collected and to meet our legal, accounting, tax, audit and dispute-resolution obligations: (a) Account registration data — retained for the life of the account plus 7 years after closure; (b) KYC and identity documents — retained for 7 years after the last transaction on the account, in line with CBN AML/CFT record-keeping rules; (c) Transaction records including ticket IDs, draw inputs and outputs — permanently retained for independent draw audit and disputes; (d) Payment processor references — retained for 7 years after settlement; (e) Support correspondence — retained for 6 years after closure of the ticket; (f) Marketing opt-out registers — retained indefinitely in order to continue honouring opt-outs; (g) Raw server logs — retained for 12 months, then aggregated and anonymised.
2. Secure disposal. Where personal data is no longer required we securely delete, destroy, or irreversibly anonymise it (overwriting, cryptographic shredding, or certified physical destruction), keeping an audit record of the disposal.
3. Technical and organizational security measures. We implement the following minimum measures: (a) TLS 1.3+ encryption for all traffic in transit; (b) AES-256 encryption at rest for identity documents, BVN, and bank account details; (c) multi-factor authentication (time-based one-time passwords) required on all internal administrative accounts and available as a user option at Dashboard → Security; (d) password hashing using Argon2id with a minimum 16 MiB memory cost; (e) role-based access controls and principle of least privilege for staff; (f) quarterly vulnerability scanning and annual penetration testing by an independent NDPC-recognised firm; (g) written Information Security Management System (ISMS); (h) staff NDPR training at onboarding and annually thereafter; (i) device management and endpoint protection on all internal endpoints.
4. Data breach notification. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, we will: (a) record the breach in our internal breach register; (b) notify the NDPC without undue delay and, where feasible, not later than 72 hours after becoming aware of it; and (c) communicate the breach to affected data subjects without undue delay where the risk is high, unless we have put in place subsequent technical and organisational measures that render the risk no longer high, or where the communication would involve disproportionate effort (in which case a public notice or similar measure will be used instead).

As a data subject under the NDPR 2019, you have the following rights in respect of your personal data. We will respond to verified requests within 28 calendar days (extendable by a further 56 calendar days where the request is complex or high-volume, in which case we will notify you of the extension within the first 28 days and explain the reason for delay). We do not charge for a first request per calendar year; further manifestly unfounded or excessive requests may attract a reasonable administrative fee based on cost.

1. Right of access. You may request confirmation of whether we are processing personal data relating to you, a copy of that data in a structured, commonly used and machine-readable format (JSON or CSV), and a description of the processing.
2. Right to rectification. You have the right to have inaccurate or incomplete personal data corrected without undue delay. You can update most profile information directly on Dashboard → Profile.
3. Right to erasure ("right to be forgotten"). You may request deletion of personal data in the circumstances set out in the NDPR, for example where processing is no longer necessary, consent is withdrawn and no other lawful basis applies, or the processing is unlawful. Exclusions apply where retention is required by Nigerian law (e.g. 7-year AML records).
4. Right to restrict processing. You may request suspension of processing where the accuracy of the data is contested, the processing is unlawful, or we no longer need the data but you require it for the establishment, exercise or defence of legal claims.
5. Right to data portability. Where processing is based on consent or on a contract and is carried out by automated means, you may receive your personal data in a machine-readable format or have it transmitted directly to another controller where technically feasible.
6. Right to object. You may object at any time to processing based on our legitimate interests (including direct marketing) on grounds relating to your particular situation. We will cease processing unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or we need the processing for the establishment, exercise or defence of legal claims.
7. Right to withdraw consent. Where we have relied on your consent to process personal data, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
8. Right to lodge a complaint. If you believe that our processing of your personal data infringes the NDPR, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng or by writing to the Data Protection Officer at privacy@raffila.com who will acknowledge the complaint within 7 business days.
9. Automated decision-making and profiling. We carry out limited automated decision-making and profiling for anti-fraud, sanctions screening, and credit-risk evaluation of referral payout requests. Where a decision based solely on automated processing produces a legal or similarly significant effect concerning you, you have the right to obtain human intervention, to express your point of view, to contest the decision, and to be given the reasons for it.

To exercise any of these rights, please email privacy@raffila.com from the email address registered to your account, include your full name and registered phone number, and clearly describe the right you wish to exercise. We may request additional verifying identity documentation before complying to protect against unauthorised access.

1. General rule. As a general matter, Raffila stores the primary copy of all personal data collected from Nigerian data subjects on servers physically located within the Federal Republic of Nigeria, operated by an NDPC-registered infrastructure provider.
2. Permitted transfers with safeguards. Where it is necessary to transfer personal data outside of Nigeria to a sub-processor for purposes described in this Policy — for example, to a global cloud provider's disaster-recovery region, or to a licensed identity-verification provider — the transfer will be made only where one of the following NDPR conditions is met: (a) the recipient country is the subject of an NDPC adequacy decision; (b) we have executed binding Standard Data Protection Clauses (SDPCs) approved by the NDPC with the recipient; (c) the recipient has Binding Corporate Rules approved by the NDPC; or (d) we have obtained your explicit, informed, written consent to the specific transfer after clearly informing you of the possible risks of the transfer in the absence of an adequacy decision and appropriate safeguards.
3. Sub-processor register. A current list of our non-Nigerian sub-processors and the safeguards applied to transfers is maintained in our Register of Data Processing Activities and is available on written request to privacy@raffila.com.

Raffila prize competitions are age-gated and are not directed at, and are not open to, children or minors under the age of 18. We do not knowingly collect, solicit, or process personal data from any person under 18.

If we learn that we have inadvertently collected personal information from a child under 18 — including, for example, where a minor fraudulently misrepresents age during registration — we will, upon becoming aware: (a) immediately disable the account; (b) remove any ticket entries from draws; (c) refund any Wallet balance to the source payment instrument; (d) permanently delete or irreversibly anonymise all personal data relating to that minor from our systems and those of our processors; and (e) retain only a minimal record of the account identifier and deletion date on a restricted blacklist to prevent re-registration.

If you are a parent, guardian or educator and believe a child under 18 has provided personal data to Raffila without your consent, please notify us immediately at privacy@raffila.com with the subject line "MINOR DATA REPORT" and we will respond within 5 business days.

1. Version control. This Privacy Policy is version-controlled and the "Last updated" date appears at the end of this Policy. Any new version supersedes all prior versions upon its effective date.
2. Material changes. If we make changes that, in our good-faith determination, materially alter your rights, our obligations, or the scope of processing described in this Policy, we will: (a) send you written notice of the changes by email to your registered address at least thirty (30) calendar days before the new policy becomes effective; and (b) publish a notice on the Site for the same period; and (c) where a change is based on a new or expanded purpose that relies on consent, we will separately request your explicit opt-in before the new processing begins.
3. Open-entry grandfathering. For entries already purchased in open competitions at the time of a material change, the Privacy Policy version in effect at the time the entry was paid for will continue to apply to that specific draw's record-keeping and winner processing unless you explicitly accept the newer version.

For questions about this Privacy Policy, the exercise of your NDPR rights, data-subject access requests, a copy of our Data Processing Register, or to report a suspected personal data breach, please contact our Data Protection Officer ("DPO") and compliance team:

Last updated: 2026-09-07. Effective for all users registering on or after this date; earlier versions retained in our version archive at privacy@raffila.com on request.