This privacy policy applies to Royal Star & Garter’s online lottery.
It describes what information we gather about you, what we use that information for and who we give that information to. It explains why and how we collect and use the information. This privacy policy also sets out your rights in relation to your information and who you can contact for more information or queries.
If you have any requests concerning your personal information or any queries with regard to our processing, please contact our Data Protection Officer at charitysecretary@starandgarter.org. You may also contact us by writing to The Data Protection Officer, Royal Star & Garter, 15 Castle Mews, Hampton TW12 2NP.
Contents
This privacy policy consists of the sections set out below. Please click on the section below for ease of navigation.
- Information about us
- Collection of information about you
- Other people’s data
- What we do with your information
- Legal basis for processing your information
- Sharing of your information
- International transfers
- Security of personal information
- Payment card security
- Cookies
- Retention of personal information
- Your rights
Information about us
In this privacy policy, references to “we”, “us”, “our” are references to The Royal Star & Garter Homes and our trading name Royal Star & Garter. We are a registered charity (registration number 210119). We and the Governors of Royal Star & Garter are the “controller” for the purposes of the UK General Data Protection Regulation (“GDPR”). Our ICO registration number is Z5712729.
Collection of information about you
We may collect and process the following data about you:
- Information you give us: The information you give us may include your name, address, e-mail address and phone number, financial and credit card information.
- Information that you give to third parties: We may receive information about you from third parties. Where we receive personal data that relates to you from a third party, we request that this third party inform you of the necessary information regarding the use of this data. Where necessary, they may refer to this privacy policy. In particular, your information may be shared with us by the operator of our lottery.
- Technical information when you visit the lottery website: including the Internet Protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, geographical location, browser plug-in types and versions, operating system and platform.
Children’s data
No child or young person under the age of 18 is allowed to participate in our lottery.
What we do with your information
When you provide personal information to us, we may use it for any of the purposes described in this privacy policy or as stated at the point of collection (or as obvious from the context of collection).
Legal basis for processing your information
We rely on one or more of the following processing conditions in order to process your personal information:
- our legitimate interests in the effective delivery of information and services to you (provided these do not interfere with your rights);
- to satisfy any legal and regulatory obligations to which we are subject;
- to perform our obligations under any contracts that we have agreed with you; or
- where no other condition for processing is available, if you have agreed to us processing your personal information for the relevant purpose.
Sharing of your information
We may disclose your personal information to our employees, officers or professional advisers as reasonably necessary for the purposes set out in this privacy policy.
Your personal information may be transferred to third party service providers who process information on our behalf. The kind of work we may ask them to do includes processing, enabling you to participcate in our lottery, answering questions about products, sending postal mail, emails and text messages, or analysing and processing card payments. We only choose partners we can trust. We will only pass personal data to them if they have signed a contract that requires them to:
- abide by the requirements of the GDPR;
- treat your information as carefully as we would;
- use the information for the purposes for which it was supplied and no other purpose; and
- allow us to carry out checks to ensure they are doing all these things.
Occasionally, we may receive requests from third parties with authority to obtain disclosure of personal data, such as to check that we are complying with applicable law and regulation, to investigate an alleged crime, to establish, exercise or defend legal rights. We will only fulfil requests for personal data where we are permitted to do so in accordance with applicable law or regulation.
We never sell or share your information to other organisations to use for their own purposes other than as explained above.
International transfers
Third party organisations engaged by us to process your personal information for the purposes set out in this privacy policy may be situated outside the United Kingdom and may therefore transfer personal information outside the UK. We will have a contract with the third party organisation requiring them to use your information only as instructed by us.
Transfers outside the UK will be only:
- to a recipient located in a country which provides an adequate level of protection for your personal information; and/or
- under an agreement or mechanism which satisfies UK requirements for the transfer of personal data to data processors or data controllers outside the UK, such as standard contractual clauses approved by the European Commission or the US Privacy Shield Framework in relation to transfers of personal data from the UK to the USA.
Security of your personal information
We have implemented generally accepted standards of technology and operational security in order to protect personal information from loss, misuse, alteration or destruction. Only authorised persons are provided access to personal information collected via the website; these individuals have agreed to maintain the confidentiality of this information. We use secure server software (SSL) to encrypt financial and personal information you input via our website before it is sent to us.
Although we use appropriate security measures once we have received your personal data, the transmission of data over the internet (including by e-mail) is never completely secure. We endeavour to protect personal data, but we cannot guarantee the security of data transmitted to or by us.
Where you or we have provided a password enabling you to access parts of our websites or use our services, it is your responsibility to keep this password confidential. Please do not share your password with anyone.
Cookies
Our website uses cookies so that we can track how users navigate through our website. We only use essential cookies on our lottery website.
Retention of personal information
We will retain your personal information only for as long it is required for the purposes for which it was collected, or as required to do so by law. When we no longer need information, we will dispose of it securely, using specialist companies if necessary to do this work for us.
Your rights
You have certain rights in relation to the personal information we hold about you. In particular, you have a right to:
- request a copy of personal information we hold about you (commonly referred to as a subject access request);
- ask that we update the personal information we hold about you, or correct such personal information that you think is incorrect or incomplete;
- ask that we delete personal information that we hold about you, or restrict the way in which we use such personal information;
- object to our processing of your personal information;
- withdraw your consent to our processing of your personal information (to the extent such processing is based on consent and consent is the only permissible basis for processing); and/or
- request portability of your personal information.
If you would like to exercise these rights, please contact the Data Protection Officer in writing. You may be asked to provide the following details:
- The personal information you want to access
- Where it is likely to be held
- The date range of the information you wish to access.
We will need to ask you to confirm your identity. If we hold personal information about you, we will give you a copy of the information in an understandable format together with an explanation of why we hold and use it. We will aim to respond to any requests for information promptly, and in any event within the legally required time limits (30 days). This timeframe may be extended by up to two months if your request is particularly complex.
We may charge for a request to access your information, if permitted by applicable law. For example, we may charge a reasonable fee based on administrative costs for providing further copies of your information.
We are not a ‘public authority’ as defined under the Freedom of Information Act 2000. We will not use our funds to respond to requests for information made under this Act.
For more information about your rights under the GDPR, please visit the website of the Information Commissioner’s Office at https://ico.org.uk/
Contact us
If you have any questions or complaints about this privacy policy or the way your personal information is processed by us, or would like to exercise one of your rights set out above, please contact us by one of the following means:
Email: charitysecretary@starandgarter.org
Post: The Data Protection Officer, Royal Star & Garter, 15 Castle Mews, Hampton, TW12 2NP.
You may also have the right to lodge a complaint with the UK’s data protection regulator, the Information Commissioner’s Office. For further information on your rights and how to complain to the ICO, please refer to the ICO website: https://ico.org.uk/