Club 100 — Privacy Notice

Who we are

Data controller: Colgrain Primary Parent Council, c/o Colgrain Primary School, Red Gauntlet Road, Helensburgh G84 7TZ.

Contact: club100@colgrainparentcouncil.co.uk. The member responsible for Club 100 is Ryan Garrett (Chair).

What we collect

• Your name and email address — to record your entry, send your welcome email and number reminders, send the links you ask for to manage your membership, and tell you privately if you win.
• Your entry — how many entries you have, your numbers, the dates you joined and left, and that you confirmed you are 18 or over and agreed to the Rules.
• Payment records — you type your bank details into GoCardless's pages (or your card details into Stripe's), not ours, and we never see them. We receive GoCardless and Stripe reference numbers, the amounts, and whether each payment was confirmed, failed or refunded.
• Winners' bank details — only if you win, through a single-use secure link we email you. They are stored encrypted, shown only to the treasurer to make the transfer, and deleted as soon as the payment is recorded. All we keep afterwards is the last four digits of the account number, our transfer reference, and which officer made the payment and when.
• Security fingerprints — to stop people repeatedly submitting our forms (joining, paying by card, “email me my number”, “manage my membership”, leaving a review), we keep a keyed one-way fingerprint of your IP address and of the email address typed in (for reviews, of our internal reference for your membership), for up to 7 days. The fingerprint cannot be turned back into the address.
• Technical logs — our hosting provider keeps short-lived server logs (such as the page requested and your IP address) to run and protect the site.

We do not collect phone numbers, and we do not use advertising, tracking or analytics cookies. The public site sets no cookies at all (officers who sign in to the admin area get one essential sign-in cookie).

Why we use it, and our lawful basis

• Contract — to give you what you signed up for: record your entry, take your payments, include you in the draws, and pay you if you win.
• Legal obligation — to keep the lottery records and accounts that Argyll & Bute Council (with whom Club 100 is registered) and the law require.
• Legitimate interests — to keep the lottery secure and fair: the security fingerprints above, the record of which officer handled each prize, and emails to officers when something needs attention (these identify members by an internal number, never by name or email address; emails about reviews give only the review's reference number).

Apart from reviews, which we publish only with your consent (see Reviewsbelow), we do not rely on consent. Apart from publishing a review you choose to leave, we never use your details for marketing or pass them to anyone to market to you.

Winners are never named

We only ever publish winning numbers and prizes — never a name — on the website and in anything else the Parent Council sends out. Each draw's published list of numbers uses anonymous holder numbers (1, 2, 3 …), so nobody can tell who holds which number.

Reviews

Added 11 October 2026.

If you choose to leave a review of Club 100 from your membership page:

• What we keep: your star rating, your comment, whether you chose to show your membership number or your first name (and what that shows, for example “Number 46” or “Jane”), when you agreed to it being published and which wording you agreed to, when it was first published, and which membership it belongs to. We never show your surname or email address with it, and we show your number only if you choose it — and on the website only while it is still yours: if you change it or leave Club 100, your review shows “Club 100 member” instead. On Facebook we never show a number: a review that shows your number is shared there as “Club 100 member”. Your number doesn't show your name, but anyone who knows your number (people you've told, and the officers who run Club 100) could recognise your review, and winning numbers are published on our Winners page.
• Why, and our lawful basis: to publish it on the Club 100 website and the Parent Council's Facebook page, with your consent — the box you tick when you send it.
• Who sees it: once a Parent Council officer has checked and published it, anyone visiting the Club 100 website and the Parent Council's Facebook page, where we may share it exactly as published, except that we never show a number there (Facebook is run by Meta, under its own privacy policy). We don't use reviews anywhere else — not on posters, flyers or anything else. Before it is published, or if it is not published, only the officers who run Club 100 see it. When you send or change it, the Club 100 mailbox gets a short email saying a review is waiting (its reference number and star rating only: not your words, your name or your membership number).
• How long: until you withdraw it. If you leave Club 100, your review stays on the website (and on Facebook, if we shared it) unless you ask us to remove it (email club100@colgrainparentcouncil.co.uk); at the latest, it is deleted when your membership record is deleted (and any Facebook post of it removed), 6 years after you leave (see How long we keep it, below).
• Withdrawing: you can withdraw your consent at any time — from your membership page, where your review is deleted from the website and our records straight away, or by emailing club100@colgrainparentcouncil.co.uk (for example, if you have left Club 100), and we will delete it within 7 days. Either way, if we shared it on the Parent Council's Facebook page, we remove that post within 7 days (the Club 100 mailbox is emailed to remind us — with only the review's reference number). It makes no difference to your membership.

How reviews are checked and published is set out in our reviews policy.

Who processes your data for us

• Vercel — hosts the website and its technical logs.
• Neon — hosts our database.
• one.com — sends and stores our email.
• GoCardless — collects Direct Debit payments. It holds your bank details under its own privacy notice.
• Stripe — takes one-off card payments, when offered. It holds your card details under its own privacy notice.

Each acts on our instructions under a data processing agreement. Where one of them processes data outside the UK (Vercel, for example, is based in the United States), it does so under the safeguards UK data-protection law requires.

We also give Argyll & Bute Council the lottery returns the law requires — totals only, not members' details unless the law requires it — and our bank processes prize transfers. We never sell or rent your data.

How long we keep it

• While you are a member: everything needed to run your membership.
• After you leave: a record of your entries, payments and any prizes for 6 years, for our accounts and the lottery records we must be able to show.
• A sign-up you never finish (no Direct Debit set up): deleted after 30 days. A card payment you never complete: deleted after 30 days.
• Winners' bank details: deleted as soon as the prize is recorded as paid — or if a new claim link is sent, if the prize goes unclaimed, or at the latest 60 days after you sent them.
• Membership links stop working after 45 minutes; security fingerprints are deleted after 7 days.

Your rights

Under UK data-protection law you have the right to:

• ask for a copy of the data we hold about you;
• ask us to correct anything that is wrong;
• ask us to delete your data (we may need to keep some records for the law — we'll tell you what and why);
• ask us to restrict how we use your data, or object to our use based on legitimate interests;
• complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113 — though we'd appreciate the chance to put things right first.

To use any of these rights, email club100@colgrainparentcouncil.co.uk.

How we protect it

• Only the Parent Council officers who run Club 100 can see members' details.
• The admin area is password-protected, and every look at a winner's bank details is logged.
• Winners' bank details are encrypted, and deleted as soon as they have been used.
• Connections to the site and to our database are encrypted.

Changes to this notice

If we change how we use your data, we will update this notice and, for any important change, email members.

Last updated: 11 October 2026
Next review: October 2027

See also our Rules & Terms and FAQ.