Who is harvesting your personal data?

22 September 2026

A man with many hats

Online sweepstakes have become a routine feature of Internet advertising. They appear in banners, pop-ups, and social media feeds, promising cash prizes, gift cards, or high-value consumer electronics. To participants, these offers resemble simple games of chance – a random winner is selected. Yet repeated exposure to these promotions and a closer examination of how they operate raises questions about whether many of them function as contests at all.

To dig deeper, we deliberately sought out active online promotions advertising “Free iPhones” and “Free Samsungs” and engaged with them as an ordinary user would, following each offer from the initial advertisement through to the final entry page. Rather than encountering isolated campaigns, we repeatedly arrived at a tightly connected cluster of Sweepstakes operations that, despite differing in brand names and visual designs, appeared to run on a shared technical, legal, and commercial infrastructure.

The Sweepstakes System and its Actors

Landing Operator

The first recurring pattern appears at the point of entry. Each promotion leads to several brands and landing pages controlled by the same type of actor, the Landing Operator. This entity designs and hosts the entry forms, acquires traffic through advertising, and collects the initial set of personal data from participants. While the Landing Operator defines the contest rules and mechanics, it typically frames its role as limited or administrative, distancing itself from responsibility for prize fulfillment or downstream use of the collected information. What happens to participant data after submission is often left vague by design.

Role: Affiliates (generates “leads” to the Contractors)

Actors:

• Time Travel Promotion LP (UK)
• Seven Go Media (CY).

Personal Data Receiver

Following the data beyond the landing page reveals a second layer of actors whose role are more commercial. Personal information submitted through these sweepstakes is disclosed (usually deep within privacy policies) and being shared with or transferred to numerous Personal Data Receivers. These include lead brokers, performance-marketing firms, and consumer-offer businesses whose commercial interest lies in the data itself. Their compensation appears unrelated to whether a prize is ever awarded. Instead, the economic value of the system appears to depend on the volume, reusability, and onward distribution of personal data generated by the sweepstakes funnel.

Role: Promotion Partner

Actors: See table

Claimed Sponsor

By contrast, responsibility for the prize is attributed to a third, more elusive role: the Claimed Sponsor. This is the entity said to be providing or funding the advertised reward. In all the cases examined for this investigation, the Sponsor’s involvement has been impossible to verify through public records. Evidence of prize escrow, bonding, or guaranteed fulfillment is typically absent, and operational links between the Sponsor and the Landing Operator are unclear. The resulting imbalance, where data flows are concrete and traceable while prize backing remains abstract, raises questions about the true economic center of the Sweepstakes model.

Actors: Unknown

As these three roles repeat across multiple promotions, a broader structure becomes visible.
Responsibility is fragmented: the Landing Operator collects data, Personal Data Receivers monetize it, and the Sponsor remains largely out of view.
Transparency is limited at every stage. The odds of winning are expressed only in general terms, dependent on undisclosed entry volumes. Verifiable winner lists, independent audits, or proof of prize delivery are rarely made public.

The “Sweepstakes system” appears designed in a way that makes external scrutiny difficult and accountability diffuse.

The Offshore Affiliates

Upon identifying the underlying operational logic, our effort shifted to identify who is behind the involved entities. Yes, we really wanted to know who would give away brand new iPhones for free.

By using a “test participant” in a “free iPhone” promotion as an entry point, we examined a cluster of sweepstakes offers that appeared to share common infrastructure. Two corporate names surfaced repeatedly: Time Travel Promotion LP, a UK-registered limited partnership and Seven Go Media, a Cyprus-registered company.

Time Travel Promotion LP (UK)

Within the sweepstakes architecture, Time Travel Promotion LP functions as a primary Landing Operator controlling entry points and initial data collection across numerous domains.

Time Travel Promotion LP is registered in the United Kingdom and owned by two offshore entities: Sturari Impex Limited and Ferton Impex Limited. Both companies are offshore corporate vehicles incorporated in Seychelles and the Marshall Islands, jurisdictions where beneficial-ownership disclosure is limited.

Public disclosures associate Time Travel Promotion LP with addresses at:

• 30-B Harkle Road, Ste 100, Santa Fe, New Mexico 87505, USA, and
• 85 Great Portland Street, First Floor, London, W1W 7LT, UK.

These very same companies have also appeared in academic and anti-corruption research as examples of nominee-style structures used to obscure ownership.

We found that across multiple branded landing pages (see list below) Time Travel Promotion LP was identified as the ultimate operator or promoter.

• VerticalMailer (operated by Time Travel Promotion LP)
• LeadMaid (operated by Time Travel Promotion LP)
• Offer-Experts (operated by Seven Media Code Ltd)
• LuxStore24 (operated by Mishlux Business LP)
• Admailers (operated by Time Travel Promotion LP)

Although these brands present themselves as separate promotions, their disclosures point to a shared legal and administrative foundation: Time Travel Promotion LP. The pattern is consistent with a single Landing Operator managing multiple front-door brands.

Seven Media Code Ltd (CY)

Once we understood the internal logic of using multiple brands in landing pages, we found a second parallel cluster of sweepstakes sites operating landing pages under the name of Seven Media Code Ltd, a Cyprus-registered company.

Seven Media Code Ltd is registered in Cyprus at Strovolou 77, Strovolos Center, Flat / Office 301, Strovolos, 2018, Nicosia, Cyprus. Our investigation identified Seven Media Code as the main vehicle behind a separate but structurally identical cluster of sweepstakes landing pages. These sites replicate the same operating model: high-volume traffic acquisition, personal-data collection, and partner-based data sharing. Just like Time Travel Promotions LP, Seven Media Code operates as a parallel landing-page operator within the same broader system.

DataSoft Solutions SA (SC)

Both clusters of landing pages and brands associated to Time Travel Promotion LP and Seven Media Code Ltd can be traced back to Seychelles registered DataSoft Solutions SA as early as 2011-2012.

DataSoft Solutions SA is a Seychelles-registered company that appears repeatedly in connection with downstream data use. It is used to conduct mass email and spam campaigns and to advertise purportedly GDPR-compliant databases. It operates the domain eurodatalist.com, which hosts privacy-policy documentation for multiple related entities. Advertising materials and unsubscribe notices list the address “DataSoft Solutions SA, PO Box 2069, Cascade, SY”, a designation that misidentifies Seychelles and provides no verifiable or accountable contact point.

Within the ecosystem, DataSoft Solutions SA functions as a key data-distribution and reuse node rather than as a prize-related entity.

Our initial findings support the idea that the sweepstakes campaigns examined here are not isolated promotions, but part of a coordinated system built around a small number of recurring companies, offshore ownership structures, and reusable technical infrastructure.

It is time to “un-offshore” these entities to find out who is pretending to give away free iPhones.

Alliot Partellas Kiliaris (CY)

Seven Media Code Ltd is registered in Cyprus using Alliott Partellas Kiliaris as a fiduciary service. The company is registered in the name of “Christiana Magniti” (8-12-1982) that since 2000 has been secretary or director of more than 500 companies in Cyprus alone. According to a recent investigation, Christiana also is the secretary of Owntrade Ltd a company associated to dating scams. This is not the only dating scams company associated with Christiana, she is also associated with Voxin Media Ltd (former Kikk Media Global Ltd) who has been flagged to run fake dating profiles.

From the Seychelles to Norway

The sweepstakes clusters consistently converge in a single operational center: Advertis, a Norwegian marketing company.

– Why is that? Well, across the Time Travel Promotion LP and Seven Media Code Ltd clusters, technical, administrative, and data-flow indicators repeatedly point back to Advertis-linked infrastructure. These links appear across multiple independent layers:

• Entities named as recipients or handlers of personal data, most notably DataSoft Solutions, have appeared in other marketing and email-distribution projects associated with Advertis.

• The shared use of eurodatalist.com as a centralized privacy-policy and compliance platform across multiple sweepstakes brands further suggests coordinated backend control.

• Technical analysis shows repeated co-location of servers and hosting environments among sweepstakes landing pages, partner domains, and known Advertis related properties.

• In addition, domain-registration records show that verticalmailer.com, one of the core sweepstakes brands, was registered by Cristian Ghica, CEO of Advertis, establishing a direct administrative link between Advertis leadership and a primary sweepstakes entry point.

Reaching to the Promotion Partners

Partner disclosures published on these sites further illuminate how participant data circulates. Dozens of companies are listed as potential recipients of the personal data collected. The “partners” are largely performance marketing or lead generation companies.

We downloaded multiple archived copies of Vertical Mailer website for the period of 5 years and collected a list of partners recipients of personal data from Time Travel Promotions or Seven Media Code.

The list of partners receiving personal data from VerticalMailer include:

The challenge of exercising our rights

When we contacted 21 companies connected to the marketing chain and the outcome was strikingly uneven.

• NO RESPONSE: Twelve companies did not respond at all or were unreachable, representing 57% of the total.
• REQUESTING PROOF: Eight companies replied but only to request copies of the marketing emails, campaign identifiers, or other proof before taking any action, accounting for 38%.
• OTHER: One company confirmed that it had placed our email address on a suppression list.

In practical terms this means that more than half of the organizations ignored the request entirely, while nearly all of the rest shifted the burden back to the recipient instead of demonstrating where the data originated or how it had been used.

Altogether, these responses point to a process that appears broken by design. Most entities either deny holding data, require the data subject to supply internal campaign evidence, or operate through third-party marketing intermediaries that obscure accountability. The result is a circular system in which no actor takes clear responsibility: data controllers claim not to hold the data, intermediaries request proof before investigating, and several organizations cannot even be reached through functional compliance channels.

This structure makes exercises of erasure and objection rights extremely difficult in practice, even though those rights formally exist on paper.

Conclusion

Obscurity by design

To conclude our investigation, we made a final attempt to obtain clarification from the actors involved in this ecosystem. In early 2026, a last round of emails was sent not only to Advertis AS’s director Cristian Ghica, but also to individuals connected to the Cyprus-based administrative and fiduciary layer surrounding the sweepstakes structure. These included Christiana Magniti, Antonis Partellas and Stelios Kiliaris, associated with Hamervate Limited and to Alliott Partellas Kiliaris Ltd (PKCY), a Cyprus-based accounting, corporate-services and international business advisory firm involved in company formation, administration, tax and fiduciary support for international clients.

Cristian Ghica did, however, provide a separate formal reply to the right-to-reply correspondence sent in advance of publication. In that response, he stated that he was engaging solely in his role as Director of Advertis AS and only on matters directly concerning that company. He argued that it is procedural incorrect to address multiple legal entities within a single inquiry and requested that any future questions be directed individually and specifically to Advertis AS. He also emphasized that some of the information requested could constitute confidential business data and therefore could not be shared with a broader group of recipients. Ghica further maintained that Advertis AS operates lawfully within the digital advertising and lead-generation sector, that the collection and monetization of user data is permissible when based on valid consent, and that the absence of a formally appointed Data Protection Officer does not imply non-compliance under the GDPR.

In our last mail to Cristian Ghica on 19 January 2026, directed to him as the Director of Advertis AS, Qurium stated:
“Your reply does not address the substantive questions raised in our correspondence. It focuses primarily on procedural considerations and general statements of principle, rather than responding to the specific factual issues identified.”
Since then, no further response was received from Ghica.

Taken together, this final exchange did not materially clarify the operational relationships within the Sweepstakes ecosystem, nor did it resolve the central question of how personal data circulates across the different entities involved. Instead, it reinforced a recurring dynamic observed throughout the investigation: responsibility is fragmented across multiple actors, each pointing to procedural limits, separate legal roles, or the need for narrowly scoped requests, while the overall data-collection and marketing system continues to function as a single, interconnected chain.