Privacy Policy

Last updated: June 2026

1. Who we are

Wright Operations Ltd (company number 14550836), trading as Hit The Drop, registered in England & Wales, is the controller of your personal data. Our registered office details are on the public record at Companies House. You can contact us about privacy at admin@hitthedrop.co.uk.

2. The personal data we collect

Depending on how you interact with us, we may collect and process the following categories of data:

Identity and contact data - your name where provided, email address, and the email we correspond with you on.
Discord identifiers - your Discord username, user ID and server membership/role data used to operate the community and verify access.
Customer profile data - information you provide so we can deliver a service, including names, delivery addresses, email addresses and phone numbers for the profiles you ask us to run.
Account credentials - where a service requires it (for example raffle entries), platform account credentials such as email/password pairs and app passwords.
Transaction and billing data - records of your orders, services, fees, deposits and subscriptions, including payment card data needed to run checkouts you have requested. Subscription card payments are processed by Stripe; we do not store full card numbers for Stripe-billed services.
Technical and usage data - IP address, device and browser type, and server logs generated by our hosting provider when you use the Site.
Analytics data (consent only) - if, and only if, you accept analytics cookies, Google Analytics 4 generates pseudonymous usage data about your visit, such as pages viewed, the type of page, which calls to action you click, approximate location derived from a truncated IP address, and the campaign tag of the link you arrived through. We configure this so that IP addresses are anonymised and no Google advertising or personalisation signals are used. We do not place your name, Discord handle, email, referral code or any order or payment detail into analytics. Search Console reports the anonymised, aggregated search queries that lead to the Site; it does not identify individual visitors.
Communications - support tickets, messages and any content you send us.
Consent records and member content - where you consent to us featuring a success post or testimonial, the content and the record of your consent.

Payment card data and account credentials are treated as particularly sensitive. We store only what is necessary to provide the service you have requested, and we protect them as described in clause 7.

3. How we use your data and our lawful bases

We use personal data for the following purposes, relying on the lawful bases shown:

To provide and administer the services you request (ACO, account generation, raffles) and to manage your account and payments - lawful basis: performance of a contract.
To operate, secure and improve the Site and community, prevent fraud and abuse, and manage our business - lawful basis: our legitimate interests, balanced against your rights.
To send service messages (for example, about your orders, subscriptions or these policies) - lawful basis: performance of a contract and legitimate interests.
To feature your success posts or testimonials - lawful basis: consent, which you can withdraw at any time.
To measure and improve the Site with analytics (Google Analytics 4) - lawful basis:consent. Analytics cookies and tracking do not run, and no analytics data is collected, unless you accept them on our consent banner. You can withdraw consent at any time (see clauses 9 and 13 and our Cookie Notice). Search Console measurement of aggregated search performance relies on our legitimate interests in understanding how people find the Site, and uses no cookies on your device.
To comply with legal obligations, including accounting and tax records and responding to lawful requests - lawful basis: legal obligation.

4. Sharing your data

We do not sell your personal data. We share it only where necessary to deliver the services, with providers who process data on our behalf, or where the law requires it. Our processors and recipients include:

Stripe - payment processing and subscription billing;
Discord - the platform our community runs on;
Google - Google Analytics 4 (web analytics, only where you have consented) and Google Search Console (aggregated search performance);
Hosting and infrastructure providers - for the Site and our systems;
Retailers and platforms - the profile details needed to place the orders and entries you have requested (for example name, address and payment details submitted at checkout); and
Professional advisers and authorities - where required for legal, accounting or regulatory reasons.

5. International transfers

Some of our providers (for example, payment or hosting providers) may process data outside the UK. Where they do, we take steps to ensure your data is protected by an adequate level of protection, such as a UK adequacy decision or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.

6. How long we keep your data

We keep personal data only for as long as necessary for the purposes set out in this policy:

Customer data - for the duration of your service, plus 12 months;
Transaction records - 7 years, to meet legal and accounting requirements;
Raffle profiles and credentials - for the duration of your active subscription, plus 30 days; and
Sensitive files sent via Discord - deleted after processing where applicable.

Deleted data may persist in encrypted backups for a limited period before those backups cycle out.

7. How we protect your data

We protect payment card data and account credentials with AES-256 encryption, secure database storage and access controls, and we review our security arrangements regularly. Credentials are used solely to provide the service you have requested (for example, entering raffles on your behalf) and are never shared with third parties. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we take our obligations seriously and act promptly on any suspected breach.

8. Your rights

Under UK GDPR you have the right to:

be informed about how we use your data (this policy);
access the personal data we hold about you;
have inaccurate data rectified;
have your data erased where there is no overriding reason to keep it;
restrict our processing in certain circumstances;
data portability - to receive certain data in a portable format;
object to processing based on legitimate interests or to direct marketing; and
withdraw consent at any time where we rely on consent.

To exercise any of these rights, email admin@hitthedrop.co.uk or contact staff via Discord. We will respond within one month, as required by law. Exercising your rights is free in most cases. Some rights are not absolute and may not apply where we have a legal reason to keep or use the data (for example, transaction records we must retain).

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk. We would, however, appreciate the chance to address your concerns first.

9. Cookies and analytics

The Site currently uses only what is strictly necessary to deliver its pages. We do not run third-party analytics, advertising or marketing cookies on the Site. If that changes, we will update this policy and ask for your consent first where the law requires it, in line with the Privacy and Electronic Communications Regulations (PECR).

10. Member testimonials and success posts

We will only publish a member's success post, win, result or testimonial - including any name, handle, image or order detail - with that member's explicit, informed consent, and we will use it only in the way agreed (for example, anonymised or credited as agreed). You can withdraw consent for future use at any time by emailing us. We never invent or exaggerate results.

11. Children

Our paid services are for adults only (18+), consistent with our Terms of Service, and are not directed at children. We do not knowingly collect data from anyone under 18 in connection with paid services.

12. Changes to this policy

We may update this policy from time to time. The version published on the Site, with its "last updated" date, is the current version. Where changes are material, we will take reasonable steps to notify members.

13. Contact

For any privacy question or to exercise your rights, contact us at admin@hitthedrop.co.uk.