Fairness, Transparency & Security

When you enter a competition you are placing your trust in us, and we take that seriously. From the moment you enter to the moment a winner is drawn, every step creates a secure, permanent record that can be independently verified. Fairness is not just something we promise, it is built into how Win A Bundle operates.

Site security and secure payments

Every page uses HTTPS encryption with an SSL certificate from Let's Encrypt, so data between your browser and our site is always encrypted. We never store card or payment details on our systems.

Card payments are processed by Trust Payments, a regulated provider running PCI DSS compliant infrastructure (the global security standard for handling card payments). Trust Payments Ltd is authorised and regulated by the Financial Conduct Authority under the Payment Services Regulations 2017, register reference 932557. Every transaction also creates an independent payment record held by the provider, including the amount, timestamp and reference.

Your tickets are protected from the moment you enter

As soon as your entry completes, your ticket numbers are assigned automatically, emailed to you, and shown in your account dashboard. Shortly after, your ticket confirmation is cryptographically timestamped (RFC 3161) by an independent service, FreeTSA.org. This is permanent external proof that your tickets existed at that exact date and time, and because it lives outside our systems it cannot be edited, backdated or removed by anyone, including us. You can verify your token any time from your account, or ask us and we will verify it with you.

Every draw has a complete audit trail

Each competition keeps a full, append-only record: order records for every entry, ticket allocation logs (which numbers were issued and when), entry timestamps, the cryptographic verification tokens, payment confirmations, email logs, and the draw record showing how the winner was selected. Even if one system failed, independent records still exist through FreeTSA timestamps, the payment provider, and our Amazon SES email archive. The integrity of every competition can always be verified.

How your ticket number is chosen

Getting your ticket number and choosing the winner are two separate steps, and it helps to keep them apart. This section is about the first: how you get your number.

Where a competition has a fixed number of tickets (which includes every instant-win competition), you don't choose your number and it isn't handed out in order. It comes from a secret shuffle that is locked in when the competition opens, before any ticket is sold, so nobody - buyer or staff - can predict or target a number. We publish a fingerprint (a SHA-256 hash) of the shuffle key on the competition page at open, and reveal the key itself once the competition ends. Anyone can then confirm the key matches the fingerprint published at open and re-run the shuffle to reproduce every ticket number, so no number could have been hand-picked. This matters most for instant wins, where the number you hold is the prize.

Where a competition has no fixed cap, numbers are simply issued in the order people enter, each one timestamped. On those draws the number itself decides nothing - the winner is chosen at the draw (below), which nobody can predict, so the order numbers were issued in can't affect who wins.

How winners are chosen

All prizes are awarded in accordance with the laws of chance. Every valid ticket has an equal chance of winning each prize, and paid and free postal entries have exactly the same odds. Depending on the competition, a draw is conducted either live or automatically, and the competition page always says which.

Live draws

Our live draws are run on ANGIE, our electronic raffle machine (a commercial Thomas Spin Electronic Raffle and Tote Machine). A secure microprocessor inside it runs a mathematical random number generator: we enter the range of ticket numbers in the draw, ANGIE picks one at random, and we match that number to the entrant list to find the winner. The winning number is chosen by the machine, never by us. On the rare occasion ANGIE is unavailable, we run the draw live in the same way using the Google random number generator.

ANGIE is fully reset before every draw, clearing its memory, so each one starts fresh and every purchased ticket has exactly the same, unskewed chance of winning. If the machine ever lands on a number that wasn't sold, we simply draw again, so a prize only ever goes to a real, purchased ticket. Under the UK Gambling Commission's framework the machine is classed strictly as an electronic draw tool rather than a gaming machine, and we operate it fully in line with those rules.

Every draw is streamed live on Facebook and YouTube and saved to our channel, so you can watch it happen in real time or play it back afterwards and check the result for yourself.

Automated draws

Automated draws use a commit-reveal process combined with a public randomness beacon, so the result is verifiable and could not have been steered before or after entries were seen.

When the competition opens, we generate a secret random seed and publish its fingerprint (a SHA-256 hash, the "commitment") on the competition page before entries close.

When the competition closes, the pool of valid tickets is fixed, and the winning ticket number is drawn deterministically from the committed seed and a public randomness beacon - the League of Entropy's drand - whose value does not exist until after entries close. The committed seed fixes the draw before entries were seen; the beacon, which nobody (us included) can predict or control, means it can't be steered after. The winner is a genuine raffle over the numbers entered (an HMAC-SHA256 calculation, sampled without bias).

We reveal the seed and publish the exact beacon round in the draw's evidence, so anyone can confirm the seed matches the earlier commitment, re-fetch the same beacon value, and re-run the calculation to reproduce the recorded winning ticket exactly. The seed is created with a cryptographically secure generator, kept encrypted until the reveal, and every stage is recorded in the audit trail.

A guaranteed winner, every time

Every competition has a guaranteed winner. Draws are never delayed or cancelled, and the advertised prize is never reduced, swapped or changed just because a competition is undersold. The draw goes ahead on schedule from the tickets that have been entered, and the winner receives exactly the prize shown on the competition page (or the cash alternative, where one is offered).

Instant wins

Some competitions include instant win prizes. Before the competition opens, these prizes are locked to specific ticket numbers, and those numbers are shown on the competition page so you can see which tickets carry a prize. When you enter, your ticket number is assigned by the secret shuffle described in "How your ticket number is chosen" above - you can't choose or predict it, and because the prize map is public and fixed, no one can target a winning ticket. If your number carries an instant win, the prize is triggered automatically, you are emailed right away, and it appears in your account. Site credit prizes are paid straight to your account balance. Every instant win is recorded in the audit trail. Two things make it verifiable: the prize map is fingerprinted when the competition opens so it can never change, and the shuffle key is revealed after the competition ends so anyone can re-run it and confirm the numbers were genuine.

Online and postal entries

Entries placed online or by post follow the same process. Postal entries are keyed in by staff before the competition closes, then move through the same system as online entries: tickets are assigned automatically, a cryptographic verification token is created, and confirmation emails are sent and archived. Once a competition locks, no new entries can be added.

Confirmation emails and archives

Every entry triggers a confirmation email with your ticket numbers and the date and time of your entry. These emails are permanently archived through Amazon SES as well as in our own systems. Once recorded they cannot be edited, and they provide extra verification alongside the cryptographic timestamp on each entry.

Refunds

If an order is refunded, the refund is recorded and timestamped by the payment provider, the associated tickets are removed from the entrant list, and they return to the available pool. This keeps the audit trail complete and ensures every ticket in the draw is valid.

Fair play

We monitor competitions to protect their integrity. If we spot suspicious behaviour or activity against the spirit of a competition, we may remove the affected entries and issue a full refund, always before the draw, so only valid entries remain. Any such action is recorded in the audit trail.

Verifying your own entry

Every entrant has independent proof of their tickets. You can verify your entry using your account dashboard (where all tickets are listed), your confirmation email (sent immediately after entry), and your verification token, which is cryptographically signed and independently timestamped by FreeTSA.org. Paste your ticket's verification code into our ticket checker at any time and it will show you exactly what that code is bound to, and let you download the timestamp token to check it against FreeTSA yourself. You can also contact us and we will verify it with you.

Draw results

After each draw, winners are notified by email and results are published on our Winners page. Each published draw has its own "Verify this draw" link showing the commitment, the revealed seed and the exact steps to re-run the calculation yourself, so anyone can confirm the outcome of every competition.

Questions

If you would like to know more about how our competitions work, our team is happy to help. Contact us any time at info@winabundle.co.uk.