STINGRAY RAFFLE
Privacy
Policy
Version
2.0 | Effective
|
Your privacy at
a glance Stingray Raffle
uses personal data to authenticate numbered raffle tickets, administer lawful
charity raffles, conduct random draws, verify winners, deliver prizes,
prevent fraud and maintain required records. Marketing and optional winner
publicity are separate choices and are not conditions of entry. |
This Privacy Policy explains how personal data
is collected, used, disclosed, retained and protected when you purchase,
activate or register a numbered raffle ticket, scan a Stingray Raffle QR code,
use a campaign website or mobile application, contact support, participate in a
draw or claim a prize. It applies to Stingray Raffle operated in the Cayman
Islands and should be read together with the Official Rules for the relevant
raffle campaign (the "Official Rules").
|
Campaign controller |
The participating charity
or other eligible non-profit organisation
identified as the legal raffle stager in the Official Rules (the
"Stager"). |
|
Technology and administration |
Stingray Media Ltd. or the
Stingray operating entity identified in the Official Rules
("Stingray"). |
|
Core entry data |
Ticket or QR identifier,
mobile number, SMS verification records, eligibility declarations, activation
status and security logs. |
|
Marketing |
Optional. You may withdraw
consent or object to direct marketing at any time without affecting your
raffle entry. |
|
Privacy contact |
info@stingraymedia.com -
use the subject line "Stingray Raffle Privacy Request". |
This Policy applies to personal data processed through Stingray Raffle
websites, QR landing pages, mobile applications, ticket activation services,
SMS verification services, customer support channels, raffle administration
systems and prize-claim processes. It also applies to personal data received
from authorised newspaper vendors, participating
charities, service providers and public authorities in connection with a raffle
campaign.
The Official Rules and any short-form privacy notice displayed at the
point of collection may provide campaign-specific details, including the
identity and contact details of the Stager, the entry period, the exact data
required, winner-announcement practices and any campaign-specific service
providers. Where a campaign-specific notice provides more specific information
about a particular use of personal data, that notice applies to that use. This
Policy does not govern unrelated editorial, radio, marketplace, employment or
other Stingray Media services.
Responsibility depends on which organisation
decides why and how particular personal data is used. The Official Rules will
identify the Stager for each campaign.
|
Organization |
Privacy role |
|
The Stager |
Ordinarily acts as the
primary data controller for the ticket-sale relationship, raffle entry,
eligibility rules, random draw, winner verification, prize fulfilment,
complaints and campaign records. |
|
The Operator |
Acts as a data processor
when it handles campaign data solely on the Stager's documented instructions.
Stingray may also act as an independent data controller for platform
security, fraud prevention, technical operations, support, legal compliance,
service analytics and its own optional direct marketing. |
|
Caymanians First Charitable
Foundation |
Where appointed for a
campaign, may act as an independent data controller for eligibility review,
fiduciary oversight, governance, audit and reconciliation. It should receive
only the data reasonably needed for those functions. |
|
Authorised vendors |
May act as agents of the
Stager for ticket distribution, sale and reconciliation. A vendor that
collects personal data for its own purposes is separately responsible for
that processing and must give an appropriate notice. |
Where two organisations jointly determine the
purposes and essential means of a processing activity, they will act as joint
data controllers and will document their respective responsibilities. The
essence of any applicable joint-controller arrangement will be made available on
request.
We collect only data that is reasonably necessary for the relevant
campaign and the purposes described in this Policy. Depending on how you
participate, this may include:
·
Ticket and purchase data: the unique ticket
number, QR token or serial number; campaign and newspaper issue; sale or
activation date and time; vendor or distribution point; ticket status; refund,
cancellation or chargeback information; and whether a ticket has already been
registered, transferred, voided or claimed.
·
Registration and contact data: mobile telephone
number, country code, SMS one-time passcode status, optional email address,
optional name, communication preferences and records showing your acceptance of
the Official Rules and this Policy.
·
Eligibility data: confirmation that you are at
least 18 years old and ordinarily resident or otherwise eligible under the
Official Rules. We may collect supporting evidence only when reasonably
necessary, particularly from a potential winner.
·
Technical and usage data: IP address, browser
type, device type, operating system, app version, time zone, language,
referring page, session identifiers, cookie or local-storage identifiers,
interaction logs, crash data and security events.
·
Winner and prize-claim data: full legal name,
date of birth, residential address, proof of identity, proof of Cayman Islands
residence or other eligibility, signature, claim correspondence, prize-payment
instructions, tax or financial information where legally required, and a signed
prize receipt or release.
·
Support, complaint and investigation data:
messages, call notes, attachments, identity-verification data, dispute details,
evidence of ticket ownership and records of how a matter was resolved.
·
Fraud and compliance data: duplicate-ticket or
copied-QR indicators, failed verification attempts, suspicious device or
network signals, sanctions or legal checks where required, internal
investigation notes and information received from law enforcement or regulatory
authorities.
·
Marketing and publicity data: marketing choices,
campaign engagement, optional profile information and, only where separately
agreed, a winner photograph, quotation, interview, voice recording or story.
We obtain personal data directly from you when you activate or register
a ticket, request an SMS code, use the platform, contact us, claim a prize or
choose to receive marketing. We may also obtain data from:
·
the Stager, the Caymanians First Charitable
Foundation or another authorised campaign
administrator;
·
newspaper vendors and other authorised
ticket distributors, primarily for ticket-sale and reconciliation records;
·
SMS, hosting, cybersecurity, analytics, payment
and prize-fulfilment providers;
·
your device or browser through cookies, local
storage, application logs and similar technologies; and
·
public authorities, law enforcement,
professional advisers, auditors or publicly available sources where necessary
for legal compliance, fraud prevention or the defence
of legal rights.
A QR code or numbered ticket should contain a unique campaign identifier
or token. We do not need to place your name, mobile number or other directly
identifying personal data inside the printed QR code itself.
The Cayman Islands Data Protection Act requires a lawful condition for
processing personal data and an additional condition where sensitive personal
data is involved. We rely on the following conditions, as applicable:
|
Purpose |
Data typically used |
Lawful condition |
|
Register and authenticate a
numbered ticket; confirm acceptance of the Official Rules; maintain the
valid-entry register. |
Ticket identifier, mobile
number, SMS verification record, eligibility declarations, timestamps. |
Performance of the raffle
contract; steps requested before entering that contract; legitimate interests
in reliable administration. |
|
Conduct the random draw,
notify a potential winner and administer the claim. |
Valid ticket register,
contact data, draw record, claim communications. |
Performance of the raffle
contract; compliance with legal obligations; legitimate interests in fair and
transparent administration. |
|
Verify age, residence,
identity and ticket ownership; deliver and account for the prize. |
Identity and residence
evidence, ticket ownership evidence, payment details and receipt. |
Performance of contract;
legal obligation; legitimate interests in preventing ineligible or fraudulent
claims. |
|
Protect the platform and
prevent copied tickets, duplicate registrations, misuse, fraud and security
incidents. |
Device, network, ticket,
authentication and investigation data. |
Legitimate interests in
security and fraud prevention; legal obligations; establishment, exercise or defence of legal rights. |
|
Maintain raffle, financial,
audit, tax, NPO and regulatory records; respond to lawful requests. |
Campaign register, draw
certificate, winner and prize records, reconciliation and supporting records. |
Compliance with legal
obligations; legitimate interests in governance, accountability and dispute
resolution. |
|
Provide support and resolve
questions, complaints, refunds or disputes. |
Contact details,
communications, ticket and transaction records. |
Performance of contract;
legitimate interests in customer service and dispute management; legal
rights. |
|
Measure service performance
and improve reliability, accessibility and user experience. |
Usage, diagnostics and
aggregated or pseudonymised analytics. |
Legitimate interests,
balanced against your rights; consent where required for non-essential
cookies or similar technologies. |
|
Send Stingray Raffle news,
reminders or other direct marketing not necessary to administer your entry. |
Contact details,
preferences and campaign engagement. |
Consent. You may withdraw
consent or require us to stop direct marketing at any time. |
|
Publish optional winner
photographs, interviews or stories beyond the minimum announcement required
for the raffle. |
Name, image, voice,
quotation and biographical details selected for publication. |
Separate, voluntary
consent; legitimate interests only for the minimum transparency announcement
described in Section 9. |
Where the Official Rules require ticket activation or registration, the
unique ticket identifier, required eligibility declarations and a verified
contact method are necessary to create a valid entry. If you do not provide
that information, we may be unable to register the ticket or include it in the
draw.
A potential winner must provide the information reasonably required to
verify identity, age, residence, ticket ownership and compliance with the
Official Rules. Failure to provide required verification by the claim deadline
may result in the prize being withheld or awarded in accordance with the
Official Rules. Marketing consent and optional publicity are not required to
enter, win or receive a prize.
Stingray Raffle is not designed to collect sensitive personal data as a
routine part of entry. Identity documents, complaint materials or fraud
investigations may incidentally reveal sensitive personal data, such as racial
or ethnic origin or alleged offences. We limit access to that information, use
it only where a condition in Schedule 3 of the Data Protection Act is
satisfied, and delete or de-identify it when it is no longer needed.
Please do not send medical information, political opinions, religious
beliefs or other sensitive personal data unless we specifically request it for
a lawful and necessary purpose.
A draw may use software to select one or more valid numbered tickets at
random. The draw is based on ticket identifiers in the valid-entry pool and is
not intended to evaluate a participant's personal characteristics, behaviour, creditworthiness or other traits.
Automated controls may identify duplicate tickets, repeated failed
verification attempts, suspicious device activity or other indicators of
misuse. A flag does not automatically establish wrongdoing. Where a proposed
decision would significantly affect you - for example, disqualifying an entry
or denying a prize - we will ordinarily provide human review, explain the
relevant reason where lawful and allow you to submit information for
reconsideration. You may also exercise any applicable rights concerning solely
automated decisions under the Data Protection Act.
To demonstrate that a raffle was conducted fairly and to allow a winner
to come forward, the Stager may publish the winning ticket number and the draw
date through the campaign website, newspaper, radio, social media or other
channels identified in the Official Rules. This minimum announcement does not
require publication of the winner's identity.
After a winner is verified, the Official Rules may permit a limited
identity announcement, such as the winner's first name and last initial,
district or island, where reasonably necessary for
transparency and fraud prevention. We will not publish copies of identity
documents, home addresses, telephone numbers, bank details or other claim
evidence.
A full name, photograph, video, audio interview, quotation or personal
story will be used for promotional publicity only with a separate, voluntary
permission. A winner may decline optional publicity without losing the prize.
Withdrawal of publicity consent will apply prospectively and may not remove
material already lawfully printed or published where removal is not reasonably
practicable.
Operational messages required to register a ticket, deliver an SMS code,
confirm an entry, notify a potential winner, manage a claim or address security
are service communications and are not direct marketing.
We send optional advertising, fundraising appeals, promotions or similar
communications to an individual only where we have a lawful basis, ordinarily
your affirmative consent. Marketing consent is separate from raffle entry. You
may unsubscribe through the method in the communication, reply "STOP"
where supported, or email info@stingraymedia.com. We may retain a minimal
suppression record so that we can respect your request and avoid contacting you
again for marketing.
The Stager, Stingray and participating charities will not treat one organisation's marketing permission as permission for
another organisation unless that sharing and the
identities of the recipients were clearly disclosed when you made the choice.
Our websites and applications may use cookies, local storage, software
development kits and similar technologies. These technologies may be used to
keep a session secure, prevent duplicate ticket claims, remember privacy
choices, diagnose errors, measure service performance and, with consent where
required, provide analytics or marketing.
·
Strictly necessary technologies operate to
provide security, authentication, load balancing and core raffle functions.
·
Analytics technologies help us understand
performance and usage. We prefer aggregated or pseudonymised
data and use consent where required.
·
Advertising or cross-context tracking
technologies are not required for raffle entry and will be used only after an
appropriate choice is presented.
You can manage non-essential technologies through the consent tool,
application settings or browser controls. Blocking necessary technologies may
prevent ticket registration, authentication or other core functions. Where a
mobile application requests camera access, the camera is used to scan a QR
code; any additional device permission will be explained when requested.
We disclose personal data only where necessary for the purposes in this
Policy, where you direct us to do so or where law permits or requires
disclosure. Recipients may include:
·
the Stager and its authorised
campaign personnel;
·
Stingray and the Caymanians First Charitable
Foundation, to the extent each performs the role described in the Official
Rules;
·
authorised newspaper
vendors and ticket distributors, limited to sale, validation, refund and
reconciliation information reasonably needed for their role;
·
hosting, database, SMS, email,
identity-verification, cybersecurity, analytics, customer-support, payment,
banking, audit and prize-fulfilment providers;
·
independent draw witnesses, auditors,
accountants, insurers, legal advisers and other professional advisers;
·
the Office of the Ombudsman, the Registrar of
Non-Profit Organisations, law enforcement, courts,
tax authorities or other competent authorities where disclosure is lawful and
necessary; and
·
a successor or prospective successor in a
genuine corporate restructuring or transfer, subject to confidentiality and
appropriate safeguards.
We do not sell or rent raffle participant personal data. We do not
disclose your contact details to unrelated charities, advertisers or commercial
partners for their own marketing unless you have been clearly informed and have
made an appropriate choice.
A service provider that processes personal data for a controller must
act under a written contract, use the data only on documented instructions,
maintain appropriate security and return or delete data as required at the end
of the service.
Some technology, communications, support or professional-service
providers may process personal data outside the Cayman Islands. Before making
an international transfer, the responsible data controller will assess whether
the destination provides an adequate level of protection or will rely on
another lawful transfer mechanism available under the Data Protection Act.
Safeguards may include written contractual protections, approved terms,
confidentiality duties, access controls, encryption, data minimisation,
transfer-risk review and limiting the data to what the recipient needs. Where
consent is used as the transfer condition, we will explain the relevant
transfer and request a valid consent. You may contact us for available
information about the countries involved and the safeguards used for a
particular campaign.
We retain personal data only for as long as reasonably necessary for the
purpose for which it was collected, including the time needed to complete the
draw and prize claim, resolve disputes, prevent repeat fraud, meet NPO and
financial-record duties and comply with law. The following are our ordinary
retention periods unless the Official Rules, a legal hold or another legal
requirement requires a different period:
|
Record category |
Ordinary retention period |
|
Incomplete activation or
failed SMS verification |
Up to 90 days after the
last activity, except associated security data may be retained longer where
needed to investigate abuse. |
|
Valid ticket registration,
entry and draw records |
24 months after the
campaign closes or the final prize-claim deadline, whichever is later. |
|
Security, fraud and
investigation records |
Ordinarily 24 months after
the event or case closure; longer where an investigation, legal claim or
repeat-abuse risk remains active. |
|
Identity-document images
used for a prize claim |
Deleted or irreversibly
redacted as soon as verification and any required review are complete,
ordinarily no later than 90 days after prize payment or final claim denial,
unless law or a dispute requires longer retention. |
|
Winner, prize,
reconciliation, financial and audit records |
At least five years from
the end of the relevant financial year where NPO financial-record rules
apply, and ordinarily no more than seven years unless a longer period is
required by law or a legal claim. |
|
Support requests and
complaints |
24 months after closure,
unless the matter forms part of a legal, regulatory, fraud or insurance
record that must be retained longer. |
|
Marketing records |
Until consent is withdrawn
or the purpose ends. A minimal suppression record may be kept for as long as
necessary to honour an opt-out. |
|
Backups |
Removed through the normal
secure backup rotation, ordinarily within 90 days after deletion from active
systems, unless an isolated backup must be preserved for security or legal
reasons. |
At the end of the applicable period, data is securely deleted, anonymised or, where it must be preserved, isolated and
restricted to the required purpose. Anonymised
information that can no longer identify an individual may be retained for
statistics, governance and service improvement.
We use technical and organisational measures
designed to protect personal data against unauthorised
or unlawful processing and against accidental loss, destruction, alteration or
damage. Depending on the sensitivity and risk, those measures are designed to
include:
·
unique, traceable ticket identifiers and
controls against duplicate activation or copied QR codes;
·
encryption in transit and, where appropriate, at
rest; tokenisation or pseudonymisation
of ticket and account identifiers;
·
role-based access, least-privilege permissions,
multi-factor authentication for administrative access and periodic access
review;
·
audit logs, monitoring, backup and recovery
procedures, vulnerability management and incident-response processes;
·
staff confidentiality and privacy training; and
·
due diligence and written data-processing
obligations for service providers.
No system can be guaranteed completely secure. You should keep SMS codes
and any account credentials confidential, protect the original numbered ticket
and notify us promptly if you believe a ticket, device or account has been
compromised.
We maintain procedures to identify, contain, investigate and document
personal data breaches. Where the Data Protection Act requires notification,
the responsible data controller will notify the affected individual and the
Cayman Islands Ombudsman without undue delay and no later than five days after
the controller should, with reasonable diligence, have become aware of the
breach. The notice will describe the nature and consequences of the breach,
measures taken or proposed, and recommended steps to reduce possible harm.
Subject to the Data Protection Act, applicable exemptions and the
circumstances of the request, you may have the right to:
|
Right |
What it means |
|
Be informed |
Receive clear information
about the identity of the data controller and the purposes for which personal
data is processed. |
|
Access |
Request confirmation of
whether your personal data is processed, a copy of relevant data and
information about its use and disclosure. |
|
Rectification, blocking,
erasure or destruction |
Ask that inaccurate data be
corrected and, where the legal conditions are met, that processing be blocked
or data erased or destroyed. |
|
Stop or restrict processing |
Object in writing to
processing likely to cause unwarranted substantial damage or distress,
subject to statutory exceptions. |
|
Stop direct marketing |
Require us at any time to
cease or not begin processing your personal data for direct marketing. |
|
Automated decisions |
Object to certain decisions
that significantly affect you and are based solely on automated evaluation,
and request reconsideration where the Act applies. |
|
Complain and seek redress |
Complain to the Cayman
Islands Ombudsman and pursue any compensation or other remedy available under
law. |
To exercise a right, send a written request to info@stingraymedia.com
with the subject line "Stingray Raffle Privacy Request" and identify
the campaign and ticket number, where available. You may also contact the
Stager using the details in the Official Rules. We may request information
reasonably necessary to confirm your identity and locate the relevant data. We
will not ask for more identity information than is proportionate to the
request.
Access requests are ordinarily handled within 30 days after receipt of a
valid written request and any information reasonably needed to verify identity
or locate the data. The period may be extended by up to a further 30 days where
the Regulations permit and you will be informed of the reason. Requests are
ordinarily free, although a reasonable fee may be charged, or a request refused
with reasons, where it is manifestly unfounded or excessive as defined by the
Regulations. Rights are not absolute; we may retain or withhold data where an
exemption, another person's rights, legal privilege, fraud prevention,
regulatory duties or legal claims require it.
Stingray Raffle is intended only for persons aged 18 or older. The Data
Protection Regulations define a child as a person under 18, and the Official
Rules require adult eligibility. We do not knowingly register children. If we
learn that a person under 18 has attempted to register, we may invalidate the
entry and delete the personal data, except for a limited record needed to
prevent repeated misuse, protect the child or comply with law.
A campaign may link to an independent bank, payment provider, app store,
social-media platform, map, messaging service, charity website or other third
party. A third party that determines its own purposes for personal data is an
independent data controller and its own privacy notice applies. A link or
integration does not mean that Stingray or the Stager controls the third
party's privacy practices.
Unless a campaign expressly states otherwise, Stingray Raffle does not
store full payment-card details. Card or bank information entered directly into
an independent payment interface is processed by the relevant payment provider
under its own terms and privacy notice.
We may update this Policy to reflect changes in law, regulatory
guidance, campaign design, technology, service providers or security practices.
The version and effective date at the beginning of the Policy identify the
current edition. Material changes will be communicated through the platform,
the relevant campaign page, email or another reasonable method before they take
effect where required. We will not use previously collected data for a
materially incompatible new purpose without providing an appropriate notice
and, where required, obtaining consent.
For questions, requests or complaints concerning personal data processed
through Stingray Raffle, contact:
|
Stingray Media Ltd. |
The Stager for a particular raffle is identified in that campaign's
Official Rules. Requests concerning the Stager's controller activities may be
sent directly to the Stager or through the Stingray contact above for routing.
You may also complain to the Cayman Islands Ombudsman, the independent
supervisory authority for data protection:
Office of the Ombudsman, 5th Floor, Anderson
Square, 64 Shedden Road, George Town; P.O. Box 2252, Grand Cayman KY1-1107;
telephone +1 345 946 6283; email info@ombudsman.ky; website https://ombudsman.ky/data-protection.
The following official sources provide the principal legal and
regulatory framework referenced in this Policy. Links were checked as of the
effective date shown above.
Cayman Islands Data Protection Act (2021 Revision): https://legislation.gov.ky/cms/images/LEGISLATION/PRINCIPAL/2017/2017-0033/2017-0033_2021%20Revision.pdf
Cayman Islands Data Protection Regulations, 2018: https://legislation.gov.ky/cms/images/LEGISLATION/SUBORDINATE/2019/2019-0017/2019-0017_SL%2017%20of%202019.pdf
Cayman Islands Ombudsman - Data Protection: https://ombudsman.ky/data-protection
Cayman Islands Ombudsman - Personal Data Breaches: https://ombudsman.ky/data-protection-organisation/personal-data-breaches
Cayman Islands Non-Profit Organisations Act
(2020 Revision): https://legislation.gov.ky/cms/images/LEGISLATION/PRINCIPAL/2017/2017-0037/2017-0037_2020%20Revision.pdf