Fairness, Transparency & Security

When you enter a competition you are placing your trust in us, and we take that seriously. From the moment you enter to the moment a winner is drawn, every step creates a secure, permanent record that can be independently verified. Fairness is not just something we promise, it is built into how Win A Bundle operates.

Site security and secure payments

Every page uses HTTPS encryption with an SSL certificate from Let's Encrypt, so data between your browser and our site is always encrypted. We never store card or payment details on our systems.

Card payments are processed by Trust Payments, a regulated provider running PCI DSS compliant infrastructure (the global security standard for handling card payments). Trust Payments Ltd is authorised and regulated by the Financial Conduct Authority under the Payment Services Regulations 2017, register reference 932557. Every transaction also creates an independent payment record held by the provider, including the amount, timestamp and reference.

Your tickets are protected from the moment you enter

As soon as your entry completes, your ticket numbers are assigned automatically, emailed to you, and shown in your account dashboard. Shortly after, your ticket confirmation is cryptographically timestamped (RFC 3161) by an independent service, FreeTSA.org. This is permanent external proof that your tickets existed at that exact date and time, and because it lives outside our systems it cannot be edited, backdated or removed by anyone, including us. You can verify your token any time from your account, or ask us and we will verify it with you.

Every draw has a complete audit trail

Each competition keeps a full, append-only record: order records for every entry, ticket allocation logs (which numbers were issued and when), entry timestamps, the cryptographic verification tokens, payment confirmations, email logs, and the draw record showing how the winner was selected. Even if one system failed, independent records still exist through FreeTSA timestamps, the payment provider, and our Amazon SES email archive. The integrity of every competition can always be verified.

How winners are chosen

All prizes are awarded in accordance with the laws of chance. Every valid ticket has an equal chance of winning each prize, and paid and free postal entries have exactly the same odds. Depending on the competition, a draw is conducted either live or automatically, and the competition page always says which.

Live draws

Live draws use ANGIE, our electronic raffle machine (the Thomas Spin Electronic Raffle and Tote Machine). The start and end ticket numbers are entered, the machine generates a number in that range, and that number is matched to the entrant list to find the winner. Every live draw is broadcast in real time on Facebook and YouTube and archived on our YouTube channel, so anyone can watch it back and verify the result. If ANGIE is ever unavailable, the draw is run live in the same way using the Google random number generator.

Automated draws

Automated draws use a commit-reveal process so the result is verifiable and cannot be changed after entries are seen. When the competition opens, we generate a secret random seed and publish its fingerprint (a SHA-256 hash, the "commitment") on the competition page before entries close. When the competition closes, the pool of valid tickets is fixed, and the winning position is derived deterministically from that committed seed and the final number of entries (an HMAC-SHA256 calculation, sampled without bias). We then reveal the seed in the draw's evidence, so anyone can confirm two things: that the seed matches the commitment published beforehand, and that re-running the calculation produces exactly the recorded winner. The seed is created with a cryptographically secure generator, kept encrypted until the reveal, and every stage is recorded in the audit trail.

A guaranteed winner, every time

Every competition has a guaranteed winner. Draws are never delayed or cancelled, and the advertised prize is never reduced, swapped or changed just because a competition is undersold. The draw goes ahead on schedule from the tickets that have been entered, and the winner receives exactly the prize shown on the competition page (or the cash alternative, where one is offered).

Instant wins

Some competitions include instant win prizes. Before the competition opens, these prizes are locked to specific ticket numbers, and those numbers are shown on the competition page so you can see which tickets carry a prize. When you enter, your ticket number is assigned randomly using the same secure generator. If it carries an instant win, the prize is triggered automatically, you are emailed right away, and it appears in your account. Site credit prizes are paid straight to your account balance. Every instant win is recorded in the audit trail, and the prize map is fixed once the competition opens so it can never change.

Online and postal entries

Entries placed online or by post follow the same process. Postal entries are keyed in by staff before the competition closes, then move through the same system as online entries: tickets are assigned automatically, a cryptographic verification token is created, and confirmation emails are sent and archived. Once a competition locks, no new entries can be added.

Confirmation emails and archives

Every entry triggers a confirmation email with your ticket numbers and the date and time of your entry. These emails are permanently archived through Amazon SES as well as in our own systems. Once recorded they cannot be edited, and they provide extra verification alongside the cryptographic timestamp on each entry.

Refunds

If an order is refunded, the refund is recorded and timestamped by the payment provider, the associated tickets are removed from the entrant list, and they return to the available pool. This keeps the audit trail complete and ensures every ticket in the draw is valid.

Fair play

We monitor competitions to protect their integrity. If we spot suspicious behaviour or activity against the spirit of a competition, we may remove the affected entries and issue a full refund, always before the draw, so only valid entries remain. Any such action is recorded in the audit trail.

Verifying your own entry

Every entrant has independent proof of their tickets. You can verify your entry using your account dashboard (where all tickets are listed), your confirmation email (sent immediately after entry), and your verification token, which is cryptographically signed and independently timestamped by FreeTSA.org. Paste your ticket's verification code into our ticket checker at any time and it will show you exactly what that code is bound to, and let you download the timestamp token to check it against FreeTSA yourself. You can also contact us and we will verify it with you.

Draw results

After each draw, winners are notified by email and results are published on our Winners page, so anyone can verify the outcome of every competition.

Questions

If you would like to know more about how our competitions work, our team is happy to help. Contact us any time at info@winabundle.co.uk.