NextBigDraw

Small print

Privacy notice

What we know about you and what we do with it. Last updated November 2026.

1. Who is responsible

Next Big Draw runs Next Big Draw and decides how your details are used.

2. What we collect

  • When you buy a ticket: your name, phone number, email address, town or area, the tickets you bought, the M-Pesa receipt number and the time you accepted the terms.
  • When you make an account: your phone number or email address and the name you give. If you sign in with Google or Apple we receive your name, your email address and an account ID from them.
  • When you take part: your vote, your wishes and your likes.
  • Automatically: your IP address, kept with orders and sign-in attempts to stop abuse.

3. Why we use it

  • To take your payment and issue your tickets
  • To send your tickets by SMS and email
  • To run the draw and contact the winner
  • To let one person vote once
  • To prevent fraud and keep the records the law asks for

We do not sell your details. We do not send marketing unless you ask for it.

4. Who else handles it

Safaricom processes M-Pesa payments. An SMS provider and an email provider deliver our messages. Google or Apple are involved only if you choose to sign in with them. Each one gets only what it needs for that job. Some of these companies store data outside Kenya.

5. What becomes public

  • If you win: your first name, the first letter of your last name, your town or area, the winning ticket number and the photos and video of the handover.
  • If you post a wish: the wish and a short form of your name, such as “Grace M.”

Your phone number and email address are never shown to other visitors.

6. Cookies and storage

We set one cookie when you sign in so the site remembers you. Your browser also keeps your ticket numbers so you can see them again on the same device. We use no advertising or tracking cookies. The prize video comes from YouTube and it only loads when you press play.

7. How long we keep it

Order and payment records are kept for seven years for tax and accounting. Accounts, votes and wishes stay until you ask us to delete them. Sign-in codes are deleted within a day.

8. Your rights

Under Kenya's Data Protection Act, 2019 you can ask for a copy of your details, ask us to correct them, ask us to delete them and object to how we use them.

If you are not happy with our answer you can complain to the Office of the Data Protection Commissioner.