This English version is provided for information purposes only. In the event of any discrepancy, the French version prevails, and these terms are governed by French law.
A surname, a Facebook username or any information making it possible to identify a person is personal data.
A person may also be identified through cross-referenced data; a simple first name combined with another piece of information may turn out to be personal data.
The persons whose personal data is displayed in prize draws are hereinafter referred to as: PARTICIPANTS, in the sense of participants in a prize draw, or WINNERS, in the sense of winners of the prize draw.
A person who publishes a prize draw is hereinafter referred to as the ORGANISER, in the sense of the organiser of a prize draw.
The site randraw.com is hereinafter referred to as the SUBCONTRACTOR, in the sense of providing a prize-draw service and hosting of the result.
To summarise what follows, the ORGANISER of the prize draw is solely responsible for the processing of the data.
It is understood that the ORGANISER of the prize draw is the only one in a position to process the data of their prize draw, and to know what that data consists of. To know whether or not that data includes personal data, to know its purpose and the contractual bases that do or do not allow them to display that data.
Where the data displayed is of a personal nature, it is the responsibility of the ORGANISER to obtain the explicit consent of the persons concerned in order to process their data.
Each ORGANISER has full knowledge of their community and of the origin of the list of participants.
If the list of participants is already public, for example through a request to tag a social media post, there is no point in anonymising the list of participants insofar as entry into the prize draw is public and implies the person's explicit consent to the prize draw being made public.
In such a case, we would recommend the following approach:
- display the list of the WINNER(s) of the prize draw.
- for the list of PARTICIPANTs, anonymise only at the request of a participant.
If the list of participants has been obtained through a contact form, we would recommend the following approach:
- display the list of the WINNER(s) of the prize draw after obtaining their prior consent.
- anonymise the list of participants at 40% or 60% to make it possible to verify the fairness of the prize draw while preserving their anonymity.
In all cases, we recommend deleting the list of PARTICIPANTs after 30 days, so that only the number of PARTICIPANTs and the list of WINNERs remain visible.
Indeed, the GDPR calls for a "data retention period limited to the strict minimum".
The SUBCONTRACTOR provides a range of tools enabling the ORGANISER to carry out a draw, to publish, unpublish, anonymise or partially or completely destroy prize-draw data.
The SUBCONTRACTOR is also responsible for issuing, or not issuing, a certificate of integrity.
Automatic procedures run by the SUBCONTRACTOR grant, or do not grant, a certificate of integrity.
In the event of the certificate being contested, whether by the ORGANISER who has not received a certificate or by a PARTICIPANT who disputes the fairness of the prize draw, the SUBCONTRACTOR will be required, in its capacity as subcontractor, to manually analyse the data of the draw.
This is why the SUBCONTRACTOR keeps, for a period of 30 days, the input data used for the prize draw, for the sole purpose of verifying the fairness of the prize draw.
For each draw, we also keep several encrypted and anonymised pieces of data from the list of participants in the form of hexadecimal figures not exceeding 45 bytes.
If the draw has not been the subject of any dispute during the first 15 days, the input data is automatically destroyed. Only the data that the ORGANISER displays is then kept.
In the event of a dispute, we keep the input data until the dispute is closed, for the sole purpose of protecting ourselves against litigation.
It is understood that in the case of a SPAM-type draw, all copies and near-copies of the prize draw will be kept until the dispute is closed.
From their administration area, the ORGANISER has access to the date on which the data will be deleted.
If a person wishes to exercise their right of withdrawal in respect of any personal data, we invite them to contact the ORGANISER of the draw, who within the meaning of the GDPR has the status of data controller and has the ability to anonymise the data via their administrator interface.
It goes without saying that all sensitive or highly personal data is strictly prohibited in prize draws.
By highly personal data we mean, without this list being exhaustive :
- a telephone number, a precise physical address, an email address, etc.
By sensitive data we mean, without this list being exhaustive:
- health data, sexual orientation, ethnic origin, political beliefs, etc.
Any person, without even having to prove their identity, may report the breach to the SUBCONTRACTOR so that a prize draw that does not comply with these rules can be deleted as quickly as possible.
If a PARTICIPANT wishes a prize draw to be audited, or if they find that sensitive or highly personal data has been published, they may contact us.
At the bottom of each prize draw, a link is provided for this purpose.
It is possible to provide your email address if you would like a reply; the email address will be kept for 7 days after the last contact.
For any request concerning data protection, you may first contact the organiser of the prize draw, who is solely responsible for the processing of the data. You may secondly contact us via the interface on your profile page. If your requests are not taken into account and you consider that your rights over your data are not being respected, you may submit a claim (complaint) to the CNIL, the French data protection authority.