Data minimised
We collect what is needed to issue tickets, verify winners, process payments, and meet legal obligations.
No ad trackers
No ad-network tracking, no data broker sharing, and no third-party advertising cookies.
Phone-first access
Ticket access is built around SMS and OTP. No password database to leak.
Our privacy position
We are not in the business of selling player data.
The product needs trust. Selling data destroys trust. So the model is simple: use data to run the platform, protect players, and meet the law.
- We use your phone number to issue tickets and notify you.
- We request KYC only when needed for prize claims or compliance.
- We do not sell your data to advertisers or brokers.
- We keep ticket and draw records where required for audit and regulation.
- You can request access, correction, deletion, or portability.
- Self-exclusion records may be retained to enforce player protection.
1. What we collect
When you buy a ticket: your phone number, the state of play you selected, the payment method used, and the ticket reference assigned to you. Phone is the only identity anchor we require.
When you create an account (optional, only for returning players): your phone number is verified once via SMS OTP. We do not store passwords because we don't use any.
When you win a cash prize over ₦10,000: government-issued ID image, a selfie, your BVN (we verify, then store only the last 4 digits), and your bank account details.
When you use the website: standard server logs such as IP address, user agent, and timestamps for security and abuse prevention. We do not use third-party analytics or ad trackers.
2. Why we collect it
Phone number — to deliver your ticket reference, draw alerts, and win notifications. This is mandatory because lottery regulation requires us to identify ticket holders.
KYC data, only for qualifying cash winners — to comply with National Lottery Regulatory Commission and tax requirements before paying cash prizes.
Server logs — to detect fraud, debug technical issues, prevent abuse, and respond to security incidents.
3. Where your data lives
Player records are stored in controlled production systems with restricted access, audit trails, and role-based permissions.
Sensitive data is encrypted at rest. Data sent between your browser and Surewina is encrypted in transit using HTTPS.
Backups are encrypted, access-controlled, and retained only for operational, security, and regulatory purposes.
4. How long we keep it
Phone number, ticket records, and audit logs may be kept for up to 7 years where required for lottery, tax, fraud prevention, and regulatory record-keeping.
KYC documents are retained only as long as required for verification, payout, legal compliance, dispute handling, and regulatory obligations.
Server logs are kept for security and abuse prevention, then deleted or anonymised when no longer needed.
If you self-exclude permanently, identifiers required to enforce that exclusion may be kept on a permanent block list so the exclusion cannot be bypassed.
5. Who sees your data
Inside Surewina: only teams that need access to do their job. Customer support may see ticket history. Compliance may see KYC. Engineering may see technical logs under access controls.
Outside Surewina: payment processors may receive the information required to process your payment. Banks may receive the information required to pay cash prizes.
Government bodies and regulators may receive information only where required by law, regulation, lawful request, investigation, or compliance process.
We never sell, rent, or share your data with marketers, ad networks, data brokers, or other third parties for advertising.
6. Your rights under NDPA
Right of access — you can request a copy of the personal data we hold about you by emailing privacy@surewina.ng.
Right to rectification — you can ask us to correct inaccurate personal data.
Right to erasure — you can request deletion of your data, subject to legal, regulatory, tax, fraud prevention, dispute, and audit retention requirements.
Right to object — you can opt out of non-essential promotional SMS. Transactional SMS such as ticket confirmations and win notifications may still be required.
Right to data portability — you can request your data in a structured format where applicable.
Right to lodge a complaint — you can complain to the Nigeria Data Protection Commission if you believe your data has been mishandled.
8. Children
Surewina is for adults only. We do not knowingly collect data from anyone under 18. If we discover an underage account or ticket purchase, we act according to law, platform rules, and responsible play requirements.
9. Contact
Privacy questions or NDPA requests: privacy@surewina.ng
Data Protection Officer: dpo@surewina.ng
Postal: Surewina Limited, attn: DPO, Lagos, Nigeria
Privacy requests
For NDPA requests, privacy questions, or account data concerns, contact the privacy team directly.