Privacy notice
Lucky Draw · version guest-2026-11-10.2 · effective 10 November 2026
Lucky Draw is a software tool provided by Geekay Infotech, ("we", "us"). Event organisers use it to collect entries and run lucky draws. This notice explains what personal data is collected, why, who is responsible for it, how long it is kept, and your rights under the Digital Personal Data Protection Act, 2023 and its Rules.
1. If you enter a lucky draw
Who is responsible. The organiser named on the entry form decides to run the draw and to collect your details, so the organiser is the Data Fiduciary for them. We act as the organiser's Data Processor: we store and process your details only on the organiser's instructions and only for the purposes below.
What is collected:
- your name;
- your mobile number;
- the date and time you entered;
- a record that you confirmed you are 18 or older and agreed to this notice, with this notice's version;
- basic technical data needed to keep the service secure, such as your network address, which is used for abuse limits and kept no longer than one day in the abuse-limit records.
What it is used for, and nothing else:
- to enter you in that one draw;
- to show your name and a partly hidden mobile number on the event screen if you win;
- to let the organiser contact you about your prize.
Who it is shared with. Only the organiser and the admins they add to that draw. It is not shared with sponsors or advertisers. It is not sold. We don't use it for our own marketing.
How long it is kept. It is removed from the draw 30 days after the draw was created, or sooner if the organiser deletes the draw or you withdraw. A copy is then kept in a locked record that no organiser or admin can see, for one year, because the Rules require data and logs to be retained for that period. After that it is deleted. We may keep it longer only if a law or a lawful order requires it.
Children. Lucky Draw is for people aged 18 or older. Under-18s should not enter. A parent or guardian may enter using their own name and number.
2. If you run draws (organisers and admins)
Who is responsible. We are the Data Fiduciary for your account data.
What is collected:
- your name and Google email, received from Google when you sign in (we receive only your basic profile and email, not your Google password or other Google data);
- your mobile number and city;
- your organisation and what you use Lucky Draw for, if you give them;
- your choice about updates, and the date you made it;
- the terms you accepted, with the date, network address and browser;
- a log of actions taken in draws you help run.
What it is used for:
- running and securing your account;
- showing your organisation's name to guests;
- support;
- meeting legal duties;
- only if you ticked the optional box, sending you updates and offers about Lucky Draw and our other apps by email, WhatsApp, SMS or phone call. Untick it in your profile any time to stop these.
How long it is kept. Until you delete your account, or three years after your last sign-in, whichever comes first. The action log is kept for up to three years.
3. Your rights
- Withdraw consent. Guests can withdraw on the same phone with "Withdraw my entry", or by asking the organiser. Admins can switch off updates in their profile, or delete their account from the dashboard. Withdrawing doesn't affect anything done before it.
- Access, correction and erasure. Ask for a summary of your data, or have it corrected, completed or erased. Guests should ask the organiser first; if you can't reach them, write to us and we'll pass the request on and help.
- Grievances. Contact our Grievance Officer, , at . We acknowledge complaints within 24 hours and respond within 15 days, and in any case within the period the law allows.
- Nominate someone. You can nominate a person to exercise these rights if you die or become unable to.
- Complain to the Board. If you're not satisfied with our response, you can complain to the Data Protection Board of India.
4. Where data is stored and who helps us
- Data is stored with Cloudflare, Inc. on servers in the Asia-Pacific region, which may be outside India. Transfers follow Indian law.
- Sign-in for admins uses Google.
- These providers act as our sub-processors under their own security and privacy commitments.
5. Security and breaches
- Connections are encrypted.
- Access is limited to each draw's own admins and checked on our server for every request.
- Sign-in uses Google, with a signed session cookie.
- We keep access logs.
- If a personal data breach happens, we will tell the organiser concerned without delay so affected people can be informed. We will also tell the Data Protection Board and affected people, as the Rules require for data we are responsible for.
6. Ads, sponsors and cookies
- We may show ads, always labelled "Ad". Organisers may show their event's sponsors.
- Neither advertisers nor sponsors receive your personal data.
- Admins get one essential sign-in cookie. We don't use advertising or tracking cookies.
7. Changes and language
We will update this notice when the service or the law changes, show the new version date here, and ask for fresh consent where the law requires it. You can ask for this notice in any language listed in the Eighth Schedule to the Constitution by writing to .