Trust and compliance
Compliance is part of how Prastix is built, not a document written at the end. Here’s who is responsible for what, and how the platform supports it.
Clear responsibilities
Your organisation runs its own lottery, raffles and draws. You hold the promoter role, and the licences or registrations that come with it, and you authorise each draw. Prastix provides the software and runs it for you under contract.
For each module we agree a written split of responsibilities, covering licences, draws, payments, marketing, age checks, self-exclusion, complaints, reporting and data protection.
You are the controller of your supporters’ personal data, and Prastix processes it on your behalf.
Nothing on this site is legal advice. Every organisation should take its own advice on its activities and obligations.
How the platform supports you
- Safeguarding
- Age checks, self-exclusion and participation limits are enforced on every route: website, app, staff screens and integrations. Staff can’t work around a restriction through another screen.
- Data protection
- Built to support UK GDPR and PECR: consent records, lawful-basis records, data requests, retention schedules and legal holds.
- Separate data
- Your organisation’s data is kept in its own database with its own credentials. Backups are made, kept and restored separately too.
- Verification
- Before regulated modules are switched on, we verify your organisation’s identity, eligibility, responsible officers and banking.
- Audit
- A tamper-evident record of every material action. Passwords, card details and unnecessary personal data are never logged.
- Independent checks
- The draw engine is independently assessed before use, alongside security testing, accessibility reviews and disaster recovery exercises.
Security
Hosted in the UK on our own infrastructure, with every server hardened, kept up to date and reachable only with individual SSH keys, never passwords. Internal traffic travels over an encrypted private network.
Data is backed up every night, encrypted before it leaves the server, with a separate copy that the live servers cannot alter or delete.
Found a security issue? Email security@prastix.com.