Privacy Policy
Last updated: August 17, 2026
1. Who controls your data
Drawby is operated by Tidalwave Dynamics Limited, registered in Cyprus under company number HE 484196, registered office Agiou Andreou 3, Pallouriotissa, 1040 Nicosia, Cyprus.
Tidalwave Dynamics Limited is the data controller for the personal data described here. In this policy, "we", "us" and "our" mean Tidalwave Dynamics Limited.
This policy explains what we collect, why, who we share it with, and what you can do about it.
2. What we collect
2.1 Information you give us
| What | When |
|---|---|
| Wallet address | When you connect a wallet |
| Email address | If you subscribe to notifications or enter a competition |
| Skill question answers | Each time you enter |
| Name, delivery address, phone number | If you win a physical prize |
| Identity documents and a selfie | If you claim a prize worth over USD 10,000 |
| Correspondence | When you contact support |
2.2 Information we collect automatically
- Transaction data. Your ticket purchases and entry history.
- Device information. Browser, operating system and device identifiers.
- Usage and error data. Pages viewed, interactions, and technical diagnostics when something goes wrong.
- IP address. Used for security, fraud prevention, and enforcing the geographic restrictions in our Terms.
2.3 Blockchain data
Your wallet address, your ticket purchases and the draw results are recorded on the Ethereum blockchain. This data is public, permanent and outside our control. Anyone can view it, and neither we nor anyone else can alter or delete it.
Section 8 explains what this means for your rights.
3. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Processing entries and issuing tickets | Performance of a contract |
| Delivering prizes and paying cash alternatives | Performance of a contract |
| Identity and age verification | Legal obligation; legitimate interests |
| Sanctions and financial crime screening | Legal obligation |
| Geographic restriction of access | Legal obligation; legitimate interests |
| Fraud prevention and platform security | Legitimate interests |
| Diagnosing errors and keeping the site running | Legitimate interests |
| Competition updates to entrants | Performance of a contract |
| Marketing emails | Consent |
| Responding to legal and regulatory requests | Legal obligation |
Where we rely on legitimate interests, we have assessed that our interest in running a secure and lawful platform does not override your rights. You can object at any time (section 8).
4. Automated decisions
Two of our checks run without a person reviewing them:
Geographic restriction. We may use your IP address to determine your location and block access from the jurisdictions listed in our Terms. This is a location check only. We do not profile you, and it does not analyse your behaviour or characteristics.
Sanctions screening. We screen wallet addresses and, where verification applies, names against published sanctions lists.
If you believe you have been blocked or refused in error, email support@drawby.com and a person will review it.
6. Sending data outside the EEA
Our database and application hosting are in the European Union, so the personal data you give us directly is stored inside the EEA. Some supporting providers are outside it, mainly in the United States and the United Kingdom.
- United Kingdom. Covered by the European Commission's adequacy decision, so no further safeguard is needed.
- United States. We rely on the EU Standard Contractual Clauses, and on the EU-US Data Privacy Framework where the provider is certified under it.
You can request a copy of the safeguards we use by emailing support@drawby.com.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and wallet data | While your account is active, then 2 years |
| Transaction records | 7 years, for tax and accounting |
| Identity verification records | 5 years after the prize is paid, for anti-money-laundering compliance |
| Delivery details | 2 years after delivery |
| Skill question answers | 12 months |
| Marketing preferences | Until you withdraw consent |
| Support correspondence | 3 years from resolution |
| Error and diagnostic logs | 90 days |
| Blockchain records | Permanent. See section 2.3 |
8. Your rights
You can ask us to:
- Give you a copy of the personal data we hold about you
- Correct data that is wrong or incomplete
- Delete your data
- Restrict how we use it
- Object to processing based on legitimate interests
- Port your data to another provider in a machine-readable format
- Withdraw consent at any time, which stops future processing based on it but does not undo what came before
Email support@drawby.com. We respond within one month. We may ask you to verify your identity first.
What we cannot delete
There are two limits.
Blockchain records cannot be deleted. Your wallet address, ticket purchases and draw participation are written to a public blockchain. We have no technical ability to remove them, and neither does anyone else. A deletion request covers the data held in our own systems, not the chain.
Some records must be kept. We are required to retain transaction and identity verification records for the periods in section 7, even if you ask us to delete them.
Complaining to a regulator
If you think we have handled your data unlawfully, you can complain to the Cyprus supervisory authority:
Office of the Commissioner for Personal Data Protection
Iasonos 1, 1082 Nicosia, Cyprus
commissioner@dataprotection.gov.cy
dataprotection.gov.cy
If you live elsewhere in the EEA you can complain to your own national authority instead.
10. Security
We protect your data with encryption in transit and at rest, access controls on internal systems, DDoS and application-layer protection through Cloudflare, and monitoring for unusual activity.
No system is completely secure, and we cannot guarantee absolute security. If a breach affects your data and creates a risk to you, we will notify you and the supervisory authority as the law requires.
11. Children
Drawby is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If we find that we have, we delete it. If you believe a minor has used the Platform, email support@drawby.com.
12. Changes
We may update this policy. If a change materially affects you, we will email subscribers and post a notice on the Platform before it takes effect. The date at the top shows the last revision.
13. Contact
Tidalwave Dynamics Limited
Agiou Andreou 3, Pallouriotissa, 1040 Nicosia, Cyprus
Company number HE 484196