Privacy policy

The controller for the processing described in sections 2 to 7 is WIZZ ADS S.R.L., having its registered office at Str. Sitarului nr. 21, bl. D8, sc. A, ap. 14, Brașov, Romania, registered with the trade register under J2024041381009, fiscal identification code 50883692, VAT number RO50883692.

Requests concerning this notice, including requests to exercise the rights set out in section 9, are to be addressed to [email protected]. The registered office is published in fulfilment of statutory identification requirements and is not a contact channel; correspondence sent to it is not processed.

A data protection officer has not been designated, the conditions set out in Article 37(1) of the Regulation not being met.

Account data. Email address, given name and family name, and, where supplied, an organisation name. Where authentication is performed through Google, the email address, name and profile image released by that provider are received in place of a password. Authentication credentials are stored in hashed form by our authentication provider and are not accessible to us.

Billing and invoicing data. The billing name, the billing address comprising street, city, postal code and country, and, where the purchase is made on behalf of a legal person, the VAT or fiscal identification code, are collected on the payment page operated by our payment provider. On completion of a payment these details are transmitted to us and retained on the account for the purpose of issuing invoices and of completing subsequent purchases. No trade register number is collected or held.

Transaction data. The fact, date and value of each purchase, the number of tokens credited, the payment reference assigned by our payment provider, and every subsequent movement of the token balance together with its stated cause. Payment card details are neither received nor stored by us at any point.

Service data. The drawings performed under the account, including their designation, the number of entries, the number of winners, the visibility selected, and the results produced.

Technical data. Server logs generated by our hosting provider, comprising IP address, timestamp, the resource requested and the response returned.

Usage data. Where, and only where, consent has been given under section 4, the pages visited, the approximate location derived from the IP address by our measurement provider, the type of device and browser, the source from which the visit arrived, and counts and categories describing progress through the service, such as the step of the drawing wizard reached, the number of entries in a list and whether a payment was begun. No entry, no name held within an uploaded file and no content of such a file forms part of this category.

No personal data is acquired from third-party sources and no data is processed for advertising purposes. Usage data is analysed in the aggregate, for the purpose of understanding how the service is used; it is not employed to evaluate personal aspects of an individual, to predict their behaviour, or to take any decision producing legal effects concerning them or similarly significantly affecting them within the meaning of Article 22 of the Regulation.

Performance of a contract, Article 6(1)(b). Account data, transaction data and service data are processed as necessary for the performance of the contract concluded on acceptance of the terms and conditions, and in order to take steps at the request of the data subject prior to entering into that contract. The provision of this data is a contractual requirement; without it the service cannot be supplied.

Compliance with a legal obligation, Article 6(1)(c). Billing and invoicing data, and the transaction records underlying it, are processed in order to comply with obligations arising under applicable accounting, fiscal and company legislation, including the obligation to issue and preserve invoices. Erasure of this data may not be effected before the expiry of the statutory preservation periods referred to in section 7.

Legitimate interests, Article 6(1)(f). Technical data is processed for the purposes of maintaining the security, integrity and availability of the service and of preventing, detecting and investigating fraud and abuse. The legitimate interests pursued are those of the controller and of its users in a secure and functioning service. A balancing assessment has been carried out and the processing has been limited to what is necessary for those purposes. The right to object under Article 21(1) applies to this processing.

Consent, Article 6(1)(a). Usage data is processed for the purpose of audience measurement, in order to understand how the service is used and to improve it. This processing is carried out only where consent has been given in the manner described in section 4, and consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal has no consequence for the use of the service, which functions identically whether consent is given, refused or later withdrawn.

Cookies are used solely for the purpose of maintaining an authenticated session. Such cookies are strictly necessary for the provision of a service expressly requested by the user within the meaning of Article 5(3) of Directive 2002/58/EC, and consent is accordingly not required.

Audience measurement is carried out using Google Analytics 4, and only where the user has given consent to it. Consent is requested by a notice presented on arrival, in which acceptance and refusal are offered on equal terms, and no analytics cookie is written and no identifier is stored before it is given. Consent may be withdrawn at any time, with the same ease with which it was given, through the “Cookie choices” link in the footer of every page. The answer is recorded in the user's own browser and is not transmitted to us.

Where consent is refused or has not yet been given, Google Consent Mode is operated with all storage denied: no cookie is written and no identifier is read, and the resulting signal carries no data by which the user could be recognised on a later visit or elsewhere.

No advertising, remarketing, cross-site tracking or profiling technology is deployed on this site in any circumstances, and the advertising signals of Google Consent Mode remain denied irrespective of the answer given. The contents of the shopping cart are stored in the user's own browser and are not transmitted to us until a payment is initiated.

Personal data is disclosed to the following categories of recipient, each acting as a processor on documented instructions under Article 28 of the Regulation:

• Supabase, for database hosting, authentication and file storage.
• Vercel, for application hosting and content delivery.
• Stripe, for payment processing and the issuing of invoices, acting in respect of payment data as an independent controller to the extent required by applicable financial regulation.
• Google, in respect of users who elect to authenticate by that means, and, where consent has been given under section 4, for the audience measurement described there. No drawing, no entry list and no content of an uploaded file is transmitted for that purpose; what is measured is limited to pages visited and to counts and categories describing the use of the service.

The seeding of each drawing involves the retrieval of a published value from the NIST Randomness Beacon. No personal data is transmitted in the course of that retrieval.

Personal data is not sold, and is not otherwise disclosed to third parties save where disclosure is required by law or by a competent authority. Where such disclosure occurs, the data subject will be informed unless we are prohibited from doing so.

Certain processors referred to in section 5 are established in, or process data in, the United States. Such transfers are effected on the basis of the standard contractual clauses adopted by the European Commission pursuant to Article 46(2)(c) of the Regulation, or on the basis of the EU-US Data Privacy Framework adequacy decision where the processor concerned is certified under it, or both. A copy of the safeguards applied may be requested at the address in section 1.

• Account data: for the duration of the contractual relationship, and erased on closure of the account, subject to the periods below.
• Billing, invoicing and accounting data: for the period prescribed by applicable accounting and fiscal legislation, which is ten years from the end of the financial year concerned under Romanian law. This period cannot be shortened at the request of the data subject.
• Drawings, the associated entry files and the published records: five years from completion, after which erasure is effected automatically. This period reflects the evidential purpose of a published record, as set out in the terms and conditions.
• Technical data: for the period applied by our hosting provider, which does not exceed thirty days.
• Usage data: for fourteen months from collection, after which it is erased by our measurement provider. Withdrawal of consent stops any further collection immediately; data already collected is erased on request under section 9, and in any event on the expiry of that period.

In respect of the personal data contained in an entry list uploaded to the service, the account holder is the controller within the meaning of Article 4(7) of the Regulation, and WIZZ ADS S.R.L. acts as a processor within the meaning of Article 4(8). The data is processed solely on the instructions of the account holder, namely to perform the drawing, to publish the result where a public drawing has been selected, and to erase the data on expiry of the period in section 7.

It is accordingly for the account holder to determine the lawful basis for the processing and publication of that data, to provide the information required under Articles 13 and 14 to the persons concerned, and to respond to requests made by them. The terms of this arrangement are those set out in the terms and conditions, which constitute the instructions referred to in Article 28(3).

A person appearing on an entry list who wishes their data to be erased should address the account holder who performed the drawing. Such a request may also be sent to [email protected], and will be transmitted to the account holder. Data subjects are advised that a published record bears a cryptographic signature covering its contents; the removal of an individual entry would invalidate that signature and with it the evidential value of the record. Where erasure is required, the record is withdrawn in its entirety rather than amended.

Subject to the conditions laid down in the Regulation, the data subject has the right to obtain confirmation as to whether personal data concerning them is being processed and access to that data (Article 15), the rectification of inaccurate data (Article 16), the erasure of data (Article 17), the restriction of processing (Article 18), the portability of data provided to us (Article 20), and to object to processing carried out on the basis of legitimate interests (Article 21). Where processing is based on consent, that consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

These rights are not absolute. In particular, the right to erasure does not apply to the extent that processing is necessary for compliance with a legal obligation, which is the case for the accounting and invoicing data referred to in section 7, nor to the extent set out in section 8 in respect of published records. Where a request cannot be met in whole or in part, the reasons will be given.

Requests are to be addressed to [email protected] and are answered without undue delay and in any event within one month of receipt, that period being extendable by two further months where necessary by reason of the complexity or number of requests, in which case the data subject will be informed within the first month. No fee is charged.

The data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement. In Romania the competent authority is the National Supervisory Authority for Personal Data Processing.

Technical and organisational measures appropriate to the risk are implemented in accordance with Article 32 of the Regulation. These include encryption of data in transit, storage of uploaded files in non-public storage accessible only by way of time-limited links, row-level access control restricting each account to its own records, and the confinement of privileged credentials to server-side execution.

In the event of a personal data breach likely to result in a risk to the rights and freedoms of natural persons, the supervisory authority will be notified in accordance with Article 33 and, where the risk is high, the data subjects concerned will be informed in accordance with Article 34.

The service is not directed at, and accounts are not knowingly established for, persons under the age of 18. Where it comes to our attention that such an account exists, it will be closed and the associated data erased.

This notice may be amended. The date of the version in force appears at the head of this page. Where an amendment materially affects the processing of personal data relating to existing account holders, they will be notified by email in advance of its taking effect.