Data protection

We collect your personal information when you:

–  Become a member of our lottery
–  Buy a lottery ticket in a Tŷ Hafan shop
–  Pay for a specified number of plays via our website
–  Make a donation to Tŷ Hafan via your lottery membership
–  Contact us via email, phone, SMS, social media, post or our websites
–  Apply to work or volunteer for us

We may also collect information about your visit to our websites. This data is not personal to you and is used to help us better understand how visitors use our site, analyse the website performance and develop the website effectively.

We collect personal information such as name, address, email, phone number and bank account details. We do not record debit card details.

We process your information to fulfil the contract we have with you (i.e. to enter you into the lottery draw), when it is our legal duty (e.g. to comply with our responsibilities under the Gambling Act 2005) and also where you have given us your consent or where we are confident it is in our legitimate interests to do so.

We use your personal details for the purposes of administering your lottery membership, participation in the weekly draw and notification of winning. The rollover and jackpot winners are usually notified by telephone.

Your personal information may be used to process a donation, for analysis purposes or for regulatory and Gambling Commission compliance reasons.

We may also use your details to keep you updated about how your support is helping Tŷ Hafan, to inform you of forthcoming events and to contact you for fundraising purposes. This could be by email (if you have given us your consent) or by post (if we believe we have a legitimate reason to do so and you have not already told us you do not want to be contacted by post).

If you no longer wish to receive these types of communications or want to change your contact preferences, please follow the unsubscribe link on a relevant email or contact us directly: call 029 2053 2300, email lottery@crackerjackpot.co.uk or write to us at Crackerjackpot, Hayes Road, Sully CF64 5XX.

To ensure the communications we send you are relevant and tailored to you, we may combine data from Experian’s Mosaic consumer data with the personal information you have given us. Mosaic is anonymous postcode-based demographic data which helps us better understand our supporter base and operate as cost effectively as possible.

We never sell or share any information about you to other organisations for their own marketing purposes.

Your details may need to be shared with third-party organisations who are working on our behalf. These organisations act as data processors and in these instances, we ensure a contractual agreement is in place to protect your data and ensure it is only retained for the necessary duration.

Your personal information may also be shared with third-party organisations to comply with legal or regulatory obligations.

Social Media and Digital Advertising

We may provide your email address to social media platforms such as Facebook to match it with your social media account. This is known as creating Custom Audiences and means we can share information with you on social media based on your interests and also make sure you are excluded from social media advertising that won’t be relevant to you. We may also provide your email address to create a Lookalike Audience of people with similar interests to you.

If we use your email address in this way, it is uploaded securely and encrypted within a portal designed for this specific purpose. It cannot be used for any other purpose. We will only use your email address if you have opted in to receive our marketing.

If you do not want us to use your data for social media advertising, please contact us on 029 2053 2300 or email us at lottery@tyhafan.org

We take all reasonable care and precautions to protect your information and use a combination of both physical and technical measures.

Online financial transactions are processed using SagePay which has the highest level of Payment Card Industry Data Security Standards (PCI DSS) compliance and any personal information you provide is encrypted.

While we take appropriate steps to protect your information online, we also protect your information offline.  We do not retain debit card details and our staff receive data protection training to ensure any personal data is handled and processed appropriately. Our computer network is guarded by firewalls and kept in a secure environment on servers located within the European Union.

Some of our premises have CCTV installed. This is for security reasons and the footage is only held for a maximum of 30 days unless we are required to disclose the images for legal reasons.

Unfortunately, the internet is not completely secure and although we will do our best to protect your information, we cannot guarantee its complete safety and any information provided is at your own risk.

If you would prefer to disable cookies, please visit http://www.aboutcookies.org.uk/managing-cookies for information on how to change your preferred browser settings.  For more information on Google Analytics cookies please visit their website.

We may link you to third party websites which have their own privacy policies. We encourage you to look at their policies as we cannot accept any responsibility or liability for the content or security of those websites.

You are in control of how we use your data.

If you think any of the information we hold on you is incomplete or inaccurate, you have the right to have this rectified. Please contact us and we will check its accuracy and correct it.

You have the right to request a copy of your personal information held by us (known as a Subject Access Request).

If you feel we should no longer be using your personal information, you can request that we stop using or erase the information we hold on you. We will confirm that the information has been restricted, anonymised or removed. However, we may not be able to comply with your request if we are required to retain your information for legal or audit purposes. If these circumstances apply, this will be fully explained to you.

To exercise any of your rights under data protection law, please contact Data Protection Officer, Tŷ Hafan, Hayes Road, Sully CF64 5XX or email dataprotection@tyhafan.org.

If you would like to make a complaint about the processing of your data, please contact us at the address above. If you are not satisfied with our response, you can complain to the Information Commissioners Office (ICO) by calling their helpline on 0303 123 1113 or via their website https://ico.org.uk/concerns/