Privacy Policy for Competition, Lottery and Raffle Entrants

What information do we hold about you and why?

Entering a competition

When entering a competition, we will collect the following information about you:

• Your full name – to process your competition entry and contact you if you are a winner
• Your date of birth (if required) – to confirm your eligibility to enter the competition, for example some competitions will be restricted to over 16s.
• Your full address – to contact you if you are a winner and, if applicable, send your prize
• Your email address (if you provide one) – to contact you if you are a winner
• Your contact telephone number – to contact you if you are a winner
• Your mobile telephone number – if you have requested further information about a competition or entered a competition by text

It is necessary to process this information to fulfil our competition terms and conditions to you. Our legal grounds in relation to this processing is contract, in that the processing is necessary for the provision of the service (entry to the competition).

We will also use your address to send you other postal communications about the Trust (including ways that you can support our cause) because we consider it to be of interest to you and that you would reasonably expect to hear from us about these activities. If you would prefer not to receive these communications, you can let us know at any time. Our legal grounds in relation to this processing is legitimate interests.

If you have provided us with an email address, we will send you other communications about the Trust if you have told us that you would like to receive these communications. Our legal grounds in relation to this processing is your consent and you have the right to withdraw your consent at any time.

Purchasing lottery or raffle tickets

When you purchase a lottery or raffle ticket from the Trust, we will collect the following information about you:

• Your name – to process your lottery/raffle entry, retain a record of your entry as a
  donation to the Trust and contact you if you are a winner
• Your address – to retain a record of your entry as a donation, contact you if you are a
  winner and, if applicable, send your prize
• Your bank details/card/cheque details – to process your entry as a donation
• Your telephone number – to contact you if you are a winner
• Your date of birth – to confirm your eligibility to enter the lottery/raffle
• Your email address – to contact you if you are a winner

We collect this information from you if you complete one of our lottery or raffle ticket entries, or apply to enter a lottery or raffle online.

When we process your information for the purposes of entering you into a lottery or raffle, we will do so to fulfil our terms and conditions to you. Our legal grounds in relation to this processing is contract, in that the processing is necessary for the provision of the service (entry to the lottery or raffle).

As stated in the lottery terms and conditions, we would like to use the winner’s name for promotional purposes. These will be only in summary, for example Mr McDonald from Glasgow. Where we do so, our lawful basis is legitimate interests – however, if you would prefer to remain anonymous, please contact lottery@nts.org.uk. We may also ask to use winners’ stories and/or photographs for publication on the website, or to promote the lottery. Where we do so, our lawful basis will be consent and we will discuss this with you prior to publication.

When we process your information for the purposes of retaining accurate records, we do so in line with the Charities and Trustee Investment (Scotland) Act 2005 and the Finance Acts of 2005 and 2010. Our legal grounds in relation to this processing is legal obligation in that it is necessary for evidencing compliance with the legislation. This information will be retained for 6 years from the end of the financial year in which the last donation payment was made.

If we use your information to contact you to let you know what difference you make to our work, what we are working on and how you can support us to achieve even more, our legal grounds are legitimate interests, because we think you would expect to hear from us about this and it is of interest to you. If you would prefer we did not contact you, you can let us know at any time. We will contact you for up to 2 years after your last donation. After this time, you will no longer hear from us unless you have provided your consent.

If you have provided us with a contact telephone number or email address, we will contact you with other communications about the Trust if you have told us that you would like to receive these. Our legal grounds in relation to this processing is your consent and you have the right to withdraw your consent at any time.

Managing self-exclusions

If you submit a Self-Exclusion Request Form and ask us to remove you from future marketing communications regarding our raffles, lottery or any other gambling-related products or services, we will collect the following information from you:

• Your name and address – to retain a record of your self-exclusion request
• Your date of birth – to help identify you from other individuals with the same name

It is necessary to process this information to fulfil our licence conditions and comply with the Gambling Act 2005. Our legal grounds in relation to this processing is legal obligation, in that it is necessary for evidencing compliance with the legislation and ensuring you do not receive further gambling-related marketing material from the Trust.

Who will have access to your data and who will we share it with?

Access to your personal data will be restricted to Trust employees and partners (as listed below) on a need-to-know basis only. Access will be provided for the purposes of supporting you as a competition or raffle entrant, contacting you regarding your entry and making sure we keep you informed about the things important to you.

We will never sell your data to third parties.

We will only ever share your information with third parties in relation to supporting your relationship with us. To make your interactions with us as efficient as possible, we will share your information with:

• Our lottery partner – for the purposes of managing your raffle entries
• Our website host – for the purposes of managing your My Trust account, facilitating donation payments and enquiries submitted through our website
• Our text marketing partner – for the purposes of entering you into a competition and sending you a link to our website competition details
• Our payments processors – for the purposes of processing secure card payments online. Please refer to the Sage Pay Privacy Policy for further information.
• Our electronic newsletter provider – for the purposes of delivering our newsletter and gathering statistics around email opening and clicks to help us monitor and improve content
• Our core systems provider – for the purposes of maintaining accurate records

Where these third parties are acting as data controllers, they are required to handle your personal data in accordance with all applicable data protection laws. For further information about how they do this, please refer to their privacy policies.

Where the third parties are acting as data processors, processing personal data on behalf of the Trust, we have contracts in place with these third parties which require them to process your personal data on our instructions only. They will not process your personal data for any other purpose and they will retain it securely.

In some cases, your data will be processed outside of the UK. Where this is the case, we will ensure that there are adequate safeguards in place (for example, the use of Standard Contractual Clauses) for the protection of your personal data.

How long will we keep your personal data?

• Information held on your record (including contact details, donations made, enquiries): 6 years from the end of our financial year
  
• Credit/Debit Card payments: held until the transaction is successfully completed
  
• Bank details (account number and sort code) where a regular Direct Debit is arranged: 6 years from the end of our financial year during which the Direct Debit came to an end
  
• Self-exclusion details: held until the self-exclusion period expires