charity lottery is operated by Club Supporter Limited (“we”, “us”, “our”). We are committed to protecting your personal data and being transparent about how we collect and use it.

This Privacy Policy explains how we handle personal information when you use our websites, applications, and lottery services.

1. Who We Are

Club Supporter Limited is the data controller responsible for your personal data unless otherwise stated.

2. Scope of This Policy

This policy applies to:

• Players who participate in lotteries hosted on our platform
• Visitors to our marketing/selling websites
• Club administrators using our SaaS services
• Individuals whose data is uploaded by clubs (e.g., supporter contact lists)

3. Controller vs Processor Roles (Important)

Depending on how you interact with charity lottery, we may act as either:

Data Controller

We act as a controller when we manage:

• Player account registration
• Regulatory compliance checks
• Payment processing obligations and transaction administration
• Platform security, fraud prevention, and auditing

Data Processor (for Clubs)

Where clubs upload supporter contact lists and send invitations, the club or charity is the controller, and we act as a processor, sending communications on their behalf.

Clubs are responsible for ensuring they have a lawful basis to upload and contact supporters.

4. Personal Data We Collect

Account and Identity Data

• Name
• Date of birth
• Email address
• Phone number
• Postal address

Payment Data

• Transaction history
• Payment status

Payment card details are processed securely by our payment provider (Trust Payments) and are not stored directly by us.

Technical Data

• IP address
• Browser/device information
• Login and security logs

Communications Data

• Emails, messages, or support requests sent to us
• Invitation communications sent via our platform on behalf of clubs

Marketing and Analytics Data

• Website usage data (Google Analytics on marketing pages only)

5. How We Use Your Data (Purposes)

We use personal data to:

• Provide access to our services
• Administer lottery participation
• Process payments and donations
• Meet legal and regulatory requirements
• Prevent fraud and ensure platform security
• Send service-related communications
• Provide customer support
• Send club invitations where clubs upload supporter lists
• Improve our websites and user experience

6. Lawful Bases for Processing (UK GDPR)

We process personal data under the following lawful bases:

7. Sharing Your Data

We may share personal data with trusted third parties, including:

Service Providers (Processors)

• Microsoft Azure (UK hosting) – cloud infrastructure hosting
• Trust Payments – payment processing
• SendGrid – email delivery
• Brevo – SMS delivery (if applicable)

These providers may only process data under our instructions and must apply appropriate security safeguards.

Clubs and Charities

Where you participate in a club lottery, relevant participation details may be shared with that club/charity (for example, to administer entries and reporting).

Legal and Regulatory Authorities

We may disclose data where required by law or in response to requests from regulatory bodies.

Business Transfers

If we sell, restructure, or transfer our business, personal data may be transferred as part of that transaction, subject to appropriate safeguards.

8. International Transfers

We primarily host data in the UK. However, some service providers (for example SendGrid or Freshdesk) may process data outside the UK.

Where this occurs, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA), Standard Contractual Clauses (SCCs), or adequacy decisions where applicable.

9. Data Retention

We retain personal data only as long as necessary.

• While your account remains active
• Up to 7 years after account closure where required for compliance with gambling and financial regulations
• Support records retained for operational purposes

Clubs uploading supporter data are responsible for their own retention policies for the data they control.

10. Your Rights Under UK GDPR

You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion (“right to be forgotten”)
• Restrict processing
• Object to processing
• Request data portability
• Withdraw consent (where processing relies on consent)

To exercise your rights, contact: support@charitylotto.co.uk

You also have the right to complain to the UK regulator: the Information Commissioner’s Office (ICO). You can find details on their website: ico.org.uk

11. Cookies and Analytics

We use cookies to ensure website functionality, improve user experience, and (on our marketing/sales website only) measure traffic and performance.

Google Analytics is used only on our marketing/sales website and not on gameplay areas where sensitive personal data is processed.

Where required, cookie consent will be obtained via a cookie banner. You can also control cookies through your browser settings. Please see our Cookie Policy.

12. Security

We take appropriate technical and organisational measures, including:

• Encryption of data in transit
• Secure UK-based hosting infrastructure
• Access controls and monitoring
• Staff confidentiality obligations

However, no system can be guaranteed 100% secure.

13. Club Invitations and Supporter Uploads

Clubs may upload supporter contact lists to invite individuals to participate. In these cases:

• The club is responsible for lawful collection and use of the data
• Messages are sent in the name of the club
• Individuals should contact the club directly regarding marketing preferences where the club is the controller

We act only as the service provider enabling delivery.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be published on our website.