Privacy Policy

The controller of the personal data processed on La Rifa is Duvan Hernandez Figueroa, tax ID (NIT) 1151961999-4, domiciled in Palmira, Valle del Cauca. Address: Vía principal 2K 420, corregimiento Caucaseco. Phone: 301 983 0863. Email: pqr@larifaco.com. In this policy we call them "La Rifa".

We process data under Colombian Law 1581 of 2012, Decree 1377 of 2013 (now part of Decree 1074 of 2015) and the other Colombian personal data protection rules, whatever country you use the platform from.

As controller we process the data of anyone who creates an account, technical browsing data, and the data of people who agree to receive news from La Rifa.

As processor we handle the data of each raffle's buyers (name, phone, email and proof of payment) on behalf of that raffle's organizer, who is its controller. We keep it so the organizer can manage their sales, we do not use it for our own purposes, and we handle it under this policy and the Terms and Conditions, which serve as the data transmission agreement between the organizer and La Rifa. The authorization a buyer gives when buying is collected on behalf of both the organizer and La Rifa. Requests about that data can go to the organizer or to us; if they reach us, we handle them or pass them on to the organizer.

• Organizers: name, email address, phone number, country, time zone, and raffle data. When signing up they declare they are 18 or older and accept the Terms and this policy; we keep the date and the version accepted.
• Buyers: name, phone number, email address, and the proof of payment they upload (an image). The email is required: it is where the buyer is told what happened to their ticket, and it makes the purchase show under "My tickets" if they have an account with that address. When buying, the buyer declares they are 18 or older and authorizes the use of their data to manage the purchase; we keep the date of that authorization and the version of this policy they accepted.
• News: name, phone number and email of anyone who ticks the news box when buying, with the date of that authorization.
• Plan payments: the payer's name and email, amount, tax, and the Bold transaction references. Card or bank account details go straight to Bold; we never see them.
• Minimal technical data (IP address, access logs) for security, plus two first-party cookies. The first holds a random identifier we use to count how many people see a page, a raffle or a plan, and how many go further; it is not derived from your IP or your account, is not shared with anyone, and ends when you clear cookies. The second remembers, for 30 days, where you first arrived from: the campaign tags on the link and the domain you came from, never the full address (a search engine URL would carry what you typed). About your browser we store whether it looks like a robot, yes or no, never the string that identifies it, and those measurements are deleted after 180 days. We use no third-party analytics.

We use the data to run the platform: managing accounts, displaying the number grid, letting the organizer validate payments, sending email notifications, charging for plans, handling requests and complaints, preventing fraud, and meeting our legal and tax obligations. The country you give us also determines which currency your plan is charged in and which tax applies to it, and your time zone is used to show your raffle dates in your own local time.

If you authorize it when creating your account, we also send you commercial emails with tips and news about the service; you can unsubscribe from the link in every email or from your profile, and notices about your raffles and payments keep arriving. We send news from La Rifa to a buyer, by email and WhatsApp, only if they tick the news box on the purchase form, which comes unticked; that authorization is stored separately, with its date, and can be withdrawn at any time. Commercial messages go out only Monday to Friday from 7:00 a.m. to 7:00 p.m. and on Saturdays from 8:00 a.m. to 3:00 p.m., never on Sundays or public holidays (Colombian Law 2300 of 2023).

We do not sell or hand over personal data. The platform is not intended for anyone under 18: organizers and buyers declare they are of legal age.

To operate we rely on providers that process data on our behalf, as processors:

• NovaCloudHosting (Netherlands): the server that runs the application and its database.
• Cloudflare (United States): storage of payment proofs.
• Resend (United States): sending and receiving email.
• Bold (Colombia): charging the organizer's plan.
• Sentry (United States): technical error logging, configured not to receive users' personal data.
• Anthropic (United States): only if the organizer uses the AI assistant with their own key. It receives the raffle's data and the numbers sold, never buyers' names, phone numbers or emails.

Your data is therefore stored and processed outside Colombia, mainly in the Netherlands and the United States, countries Colombia's Superintendency of Industry and Commerce recognizes as providing an adequate level of data protection. These are transmissions to processors (art. 25 of Decree 1377 of 2013): each provider may use the data only to provide its service to us. API keys entered by organizers are stored encrypted.

We keep account data while the account is active. Buyer data (name, phone, email and payment proof) is erased six months after the draw date; only which numbers sold and for how much is kept. If you delete your account, your data stays locked, unused, for one year to handle possible claims, and is erased after that. Plan payments keep the payer's name and email for ten years, the period commercial law requires for accounting records (art. 60 of the Colombian Commercial Code), and are erased after that. News data is kept until the person unsubscribes.

Our databases remain in force for as long as La Rifa provides the service.

As the owner of your data you have the right to:

• know, update and correct your data;
• ask for proof of the authorization you gave us;
• be told how we have used your data;
• withdraw your authorization and ask us to delete your data, unless a law or a contract requires us to keep it (for example, the tax records of a payment);
• access your data free of charge;
• file complaints with Colombia's Superintendency of Industry and Commerce (SIC) for breaches of data protection law.

You can delete your account yourself from your profile, and unsubscribe from commercial emails from the link each one carries.

Write to pqr@larifaco.com or use the contact form. Include your name, the email or phone you used on La Rifa, what you are asking for and, for a complaint, the facts and any documents you want to rely on. Requests are handled by Duvan Hernandez Figueroa.

• Inquiries (what data we hold and how we use it): we answer within 10 business days of receiving the request. If we cannot, we tell you why and answer within the following 5 business days.
• Complaints (correcting, updating or deleting data, withdrawing authorization, or reporting a breach): we answer within 15 business days from the day after we receive it. If we cannot, we tell you why and answer within the following 8 business days. If the complaint is missing information, we ask for it within 5 days; if two months pass without it, the complaint is considered withdrawn.

Before going to the SIC you must have filed the inquiry or complaint with us (art. 16 of Law 1581 of 2012). The SIC is at www.sic.gov.co.

This policy is effective from October 6, 2026. If we change it in a substantial way (who the controller is, what we use the data for, or who we transmit it to), we will tell you by email before the change applies; if the purpose changes, we will ask for a new authorization.