Privacy Policy
1. Who we are
The data controller is Beverley Round Table, a Small Society Lottery registered with East Riding of Yorkshire Council (registration number to be confirmed). The person responsible for the lottery is the designated promoter. For any privacy question, contact us at our support email.
2. What we collect
- When you enter: your name and email address, the number of tickets, your ticket number(s), and whether you've confirmed you're 16 or over and consented to your first name being shown if you win.
- If you win: the UK bank details you provide to receive your prize (account name, sort code, account number).
- Payment: your card payment is handled entirely by Stripe. We never see or store your card number.
3. Why we use it, and our legal basis
- To enter you into the draw, take payment, and contact you about your entry — on the basis of our contract with you (these are the steps needed to provide the draw you asked to join).
- To notify and pay a winner — same contractual basis.
- To keep records required by the Gambling Act 2005 and by tax/accounting law — on the basis of our legal obligations.
- To show a winner's first name, last initial and ticket number on the website — only with your consent, which you can decline or withdraw.
4. Who we share it with
We do not sell your data or share it for anyone's marketing. We use a small number of trusted service providers who process data on our behalf:
- Stripe — to process your payment securely.
- Google — our entry records are held in Google Workspace (Sheets), with access limited to authorised Beverley Round Table organisers.
- Cloudflare — to serve and protect the website.
We may also disclose information where we are legally required to, for example to the licensing authority or HMRC.
5. How long we keep it
We keep your details only as long as we need them. Because this is a registered lottery, we're required to retain records of each draw (at least 3 years for lottery records, and up to 6 years for financial records). After that, personal details are deleted or anonymised — we keep anonymous totals for our accounts but remove names and email addresses. A winner's bank details are deleted once the prize has been paid.
6. Where your data is held
Our providers (Stripe, Google, Cloudflare) may process data on servers outside the UK. Where they do, they rely on safeguards recognised under UK data protection law to keep your data protected to the same standard.
7. Cookies
This website does not set tracking or advertising cookies. When you go to pay, Stripe's checkout uses cookies necessary for the payment and fraud prevention, and Cloudflare may set a cookie to keep the site secure. We don't use these to track you across other sites.
8. Your rights
Under UK GDPR you have the right to: access the data we hold about you; have it corrected; have it erased; restrict or object to our use of it; receive a copy in a portable form; and withdraw any consent you've given. To exercise any of these, email us using the contact above.
Please note we may need to keep some information even after a request to erase it, where the law requires us to retain lottery or financial records (for example, if you've recently won, or a return has not yet been filed). We'll explain if that applies.
9. Complaints
If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
10. Changes
We may update this policy from time to time. The version published here is the one that applies.