Privacy Notice — Club 100

Club 100 — Privacy Notice

Draft for review. This is a plain-English draft prepared for Colgrain Primary Parent Council. Before publishing, please review it and verify compliance with UK data-protection law. This is not legal advice. Items in [square brackets] need to be completed.

Who we are and how to contact us

Data Controller: Colgrain Primary Parent Council, Helensburgh, Scotland.

Contact: club100@colgrainparentcouncil.co.uk

Responsible person: [Promoter name / Chair of Parent Council]

If you have any questions about how we use your data, please get in touch using the contact details above.

What personal data do we collect?

When you enter Club 100, we collect:

Your name — to identify you as a player and to contact you if you win.
Your email address and/or phone number — to contact you about your entry, payment reminders, and to notify you if you win.
Payment details — your bank account details for Direct Debit (processed securely through our payment processor, GoCardless), or card details if paying by card as a backup.
Winners' payout details — if you win, we email you a single-use link to a secure form where you enter the account to pay your prize into. We never ask for these by phone, text or social media. They are held encrypted, shown to the treasurer once at the moment of the transfer, and deleted automatically as soon as the payment is recorded — leaving only the last four digits and our own transfer reference. Anything unused is deleted automatically within 60 days.

Why do we collect it?

To run the lottery — to record your entry, assign your membership number(s), track how many entries you hold, and manage the draw.
To take payment — to process your monthly Direct Debit or card payment safely and securely.
To contact winners — to tell you privately if you've won and to arrange payment of your prize.
To keep records — to maintain records required by Argyll & Bute Council (the licensing authority), to prove the lottery is run fairly and legally.
To communicate with you — to send payment reminders, important notices about the lottery, and answers to your questions.

What is the legal reason we can use your data?

Contract: We need your data to fulfil the lottery subscription contract (you pay £5, you get a chance to win).
Consent: You have told us we can use your data to run the lottery and contact you.
Legal obligation: We must keep records to satisfy Argyll & Bute Council's requirements for small-society lottery licensing.

Who do we share your data with?

Your data is shared only with:

GoCardless (and Stripe, if card payments are used) — our secure payment processors. They handle Direct Debit and card payments on our behalf but do not use your data for any other purpose.
Argyll & Bute Council — the licensing authority. We provide required records to prove the lottery is run fairly and legally (they do not receive individual player data unless required by law).
Your bank — for Direct Debit processing only.

We do NOT sell, rent, or share your personal data with anyone else. Our public winners page shows only winning numbers, never names.

How long do we keep your data?

Active players: While you are subscribed to Club 100, we keep your data to run the lottery and process payments.
After you cancel: We keep a record of your participation and any prizes you won for 6 years (required by the licensing authority and for tax purposes if applicable).
Payment details: Payment information (bank account and card details) is kept only as long as needed to process your payments, then securely deleted.

All data is stored securely and is accessed only by Parent Council members who need it to run the lottery.

Your rights

Under UK data-protection law (GDPR and the Data Protection Act 2018), you have the right to:

Access your data — ask us what information we hold about you and get a copy.
Correct your data — ask us to fix any information that is wrong or out of date.
Delete your data — ask us to erase your data (though we may need to keep records for legal reasons).
Complain to the ICO — if you believe your data has been misused, you can complain to the Information Commissioner's Office (ICO) at www.ico.org.uk.

To exercise any of these rights, contact club100@colgrainparentcouncil.co.uk.

How we protect your data

All personal data is stored securely.
Only authorised Parent Council members can access player information.
Payment details are handled by trusted, secure payment processors (GoCardless, and Stripe if card payments are used).
We review our security regularly to keep your data safe.

Changes to this privacy notice

We may update this notice from time to time if our practices change. We'll let you know of any major changes by email.

Last updated: [Date to be inserted by Parent Council]
Next review date: [Date to be inserted — suggest annual review]

See also our Terms & Conditions and FAQ.