What personal data do we collect? 

As a Labour Lottery participant (“Player”) we will use the following categories of your personal data (section 4 outlines clearly what we use your personal data for): 

• Title; First name & surname; Home Address(es) including Post Code; Email Address(es); Phone Number(s); Date of Birth; Age; 
• Photograph(s)/image(s) & testimonial(s) (if a Player is a winner);  
• Survey Answers (where a Player decides to complete a survey);  
• Behavioural difficulties (where a Player has completed a Self-Exclusion form);  
• Lottery login details; Pseudonymised identifiers (Player Lottery Number(s) & internal Player monitoring IDs that may be associated to a Player);  
• Either, copy of Driver’s Licence, Passport or other relevant proof of identity identifier (for identity verification);  
• Further Personal Data shared voluntarily from you within any digitally recorded correspondence (e.g. email, video calls etc.);  
• Bank Details including bank name, account number, & sort-code, Payment card information (direct debit and transaction management); and 
• Political opinion (where you have indicated within the Lottery contact preference centre or in correspondence a desire for further involvement with Labour as a political party separate to the Labour Lottery). 

Where do we get your personal data? 

We will collect personal data in a variety of ways and at a variety of times when you are a Player. We refer to “direct data collection” when data is collected directly from you and we refer to “indirect data collection” when the data is not collected directly from you). We will collect personal data about you in the following ways: 

• From yourself when you became a member, supporter or volunteer of the Labour Party and told us you are happy for us to contact you about updates or events we conduct (Direct data collection); 
• From yourself when you sign up to become a Player of the Labour Lottery (Direct data collection); 
• From yourself when you complete a survey either as a winner or as a participant and player of Labour Lottery (Direct data collection); 
• From yourself when we have email, video call or phone conversations with you and you volunteer further personal data about yourself (Direct data collection); 
• From yourself, if you have given us permission to do so, when you are a winner and we take photos and/or videos and/or further circumstantial information about you or your family to be used as promotional materials for Labour Lottery (Direct data collection); 
• From yourself when you complete a self-exclusion form on the website (Direct data collection) [self-exclusion form can be found here: https://labour.charitypayments.co.uk/e-self-exclusion]; and 
• From age verification, financial transactional, or anti-money laundering service providers (Indirect data collection). 

What do we use your personal data for and what is our lawful basis for using it? 

We will use your personal data for the following purposes and on the following lawful bases. The table below is relevant to all data subjects who are Players of the Labour Lottery:  

Purpose for using personal data	Lawful basis for using
For you to join/sign up for the lottery to become a Labour Lottery “Player”.	The lawful basis we shall be relying in accordance with UK GDPR Article 6.1(b) where the use your personal data is necessary in the performance of a contract which you have agreed to or where we are working to enter into a contract with you.
To notify you if you have won and interact with you to supply your winnings.
To process monies so you are able to participate in the Lottery.
To send you notification emails to inform you about: Cancellations, Lottery Entry communications, Direct Debit management, Lottery Numbers Reminders, Winner Notification, inabilities to claim monies.
To create statistics that we must submit to the Gambling Commission as part of our Annual Return to them.
To conduct age verification checks in accordance with the Gambling Commission requirements. This is to make sure you are not underage.	The lawful basis we shall be relying on is the legitimate interest of the Data Controller in accordance with UK GDPR Article 6.1(f). [Note: There is no law that specifies this as a requirement although is required in the Gambling Commission Licence Conditions and Codes of Practice: 3.2.13 – Remote lottery Social Responsibility code. This is a condition of our gambling licence.]
To send you marketing material for the lottery according to your preferences.	The consent you have provided us for this use of your personal data in accordance with UK GDPR Article 6.1(a).
To conduct Anti-Monday Laundering checks on Players in accordance with UK Gambling Laws.  You can find our Anti-Monday Laundering Policy here: https://labourlottery.org/policies/anti-money-laundering-policy/	Compliance with a legal obligation under UK GDPR Article 6.1(c). The legal obligation is the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, and the Proceeds of Crime Act 2002. Where any special categories of your personal data are processed within these checks it is in accordance with GDPR Article 9.2(b) for employment, social security and social protection reasons (authorised by the pre-mentioned law).
Where you are a large prize winner we use your personal data to make contact with you to ask if you would like to provide a testimonial or be part of promotional materials for the Labour Lottery. This is in the form of a survey.	The lawful basis we shall be relying on is the legitimate interest of the Data Controller in accordance with UK GDPR Article 6.1(f).
If you provide your consent we will use your personal data in public facing promotional materials. You can withdraw your consent at any time.  Please note: Where you have been included printed in promotional material we may not be able to remove the information about you although we will remove your information when we re-print similar materials.	The consent you have provided us for this use of your personal data in accordance with UK GDPR Article 6.1(a).
To make sure Players are based in Great Britain (GB) only (for the avoidance of doubt, this excludes Northern Ireland, the Channel Islands, Isle of Man, BFPO addresses). NOTE: payment pages are set to exclude post codes beginning with IM, GY, BT, and JE to try and prevent those residing in those outside GB territories (but still within the UK) from entering.	The lawful basis we shall be relying on is the legitimate interest of the Data Controller in accordance with UK GDPR Article 6.1(f).
To conduct statistical monitoring of the Lottery to monitor for issues and improvements we are able to make.
To create pseudonymised identifiers to help reduce identifiability and allow us to monitor your activities within our systems.
To handle inquiries by you about the Lottery (handled either by Sterling Lotteries or Labour) by phone or email.
So you are able to register for self-exclusion and we can take appropriate action such as not targeting you with marketing material for the period of your self-exclusion (minimum 6 months).  This is to reduce gambling harms. Labour registers this on our internal customer relationship management system. All the controls and mechanisms for social responsibility in gambling are in accordance with the Gambling Commission LCCP. Self-Exclusion Form can be found here: https://labour.charitypayments.co.uk/e-self-exclusion	Compliance with a legal obligation under UK GDPR Article 6.1(c). The legal obligation is the Gambling Act 2005.
To return funds to you where you have registered for self-exclusion and still have a positive fund amount.	The lawful basis we shall be relying in accordance with UK GDPR Article 6.1(b) where the use your personal data is necessary in the performance of a contract which you have agreed to.
To take you off the self-exclusion list when you make contact with us (this will be only after the minimum 6 month period has finished).	The lawful basis we shall be relying on is the legitimate interest of the Data Controller in accordance with UK GDPR Article 6.1(f).
Where you have indicated in your Lottery profile preferences that you wish to interact with, or have further involvement with, or be notified of the development with the Labour Party or politically relevant content we will send you further information, or make contact with you.	The consent you have provided us for this use of your personal data in accordance with UK GDPR Article 6.1(a). The consent you have provided us for this use of your personal data in accordance with UK GDPR Article 9.2(a), with particular reference to an inference of your political opinion.
To identify personal data and take relevant action upon submission of a data subject rights request. Note: any data subject rights requests submitted in the context of the lottery will be for personal data processed within the lottery only unless to specifically state otherwise.	Compliance with a legal obligation under UK GDPR Article 6.1(c). The legal obligation is the UK General Data Protection Regulation to uphold your data protection rights. Special categories of personal data used for the purpose stated will be under UK GDPR Article 9.2(g).
To be able to assess any impact on individuals of a data breach involving personal data held on Labour Party systems or on third party systems.
To help protect an individual from neglect or physical, mental or emotional harm, or protect the physical, mental or emotional well-being of an individual.	Use of the personal data is necessary to protect the vital interests of an individual or individuals in accordance with UK GDPR Article 6.1(d). Special categories of personal data used for the purpose of Substantial Public Interest (Preventing or detecting unlawful acts; Protecting the public; Regulatory requirements) under UK GDPR Article 9.2(g).
To deal with legal claims and ongoing litigation cases.	Compliance with a legal obligation under UK GDPR Article 6.1(c). The legal obligation is the UK General Data Protection Regulation to uphold your data protection rights. Special categories of personal data used for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity under UK GDPR Article 9.2(f).

If you have interacted with Labour in a different way and if you expected to see something different to the list above, you can access all of our privacy notices by clicking here. If it is still not there, feel free to get in touch as mentioned below. 

Who do we share your personal data with? 

Any data shared with the below categories of recipients is the minimum necessary for the task they have been instructed to carry out on our behalf or in conjunction with us. Each category of recipient is subject to review by the Data Protection Team to make sure they have the right methods in place for keeping your personal data secure. 

Where the sharing of personal data is within the context of a product or service being supplied under contract to Labour, a Data Processing Agreement, in accordance with GDPR Article 28 is put in place. This makes sure the supplier cannot use your personal data outside of the list of uses above. 

Within the purposes of using your personal data, as listed above, we will share your personal data with the following: 

1. Lottery platform service provider, also known as an External Lottery Manager (Sterling Management Centre Limited); 

2. Digital communications and storage providers; 

3. Online survey platform providers; 

4. Age verification service provider; 

5. Payment processing providers; 

6. Anti-money laundering service providers; and 

7. Labour Party platforms (where you indicated your desire to interact with us outside of the Lottery). 

There may be scenarios where we are subject to a legal obligation to disclose or share your personal data, such as with law enforcement agencies, regulatory bodies or public authorities in order to prevent or detect crime, or prove we have adhered to their request. We will only ever disclose your personal data to these third parties to the extent we are required to do so by law. 

Data sharing with a third-party organisation that is not a supplier of a product or service to Labour does not occur unless there is a legal obligation or sound lawful purpose for such sharing.  For any such sharing we put a Data Sharing Agreement in place between Labour and the third-party containing specific information in accordance with the Information Commissioner’s Office ‘Data sharing code of practice’.  

This will include giving only relevant and often only geographically restricted access to your personal data to our local Labour Party organisations, Labour Candidates hoping to be elected, Labour Councillors, Labour Mayors and Labour Members of Parliament (MPs) so they can all conduct their democratic engagement activities. 

You can find further information on how local Labour Party organisations, Labour Candidates hoping to be elected, Labour Councillors, Labour Mayors and Labour Members of Parliament (MPs) use your personal data on their respective websites and more generally within our list of privacy notices which can be accessed by clicking here. 

Information on the meaning of ‘democratic engagement’ for national and local political parties, and their candidates and elected representatives can be found by clicking here. 

In all circumstances, the unlawful and unauthorised sharing of copies of personal data in which the Labour Party is the data controller is expressly prohibited. Any unauthorised sharing of Labour Party data is classified as a data breach which we will record and report to the ICO as required. 

How long will we keep your personal data? 

Data shall be reduced, redacted, de-identified and deleted at appropriate times so we retain the minimum amount of data possible throughout the running of the Labour Lottery.   

We keep your personal data for at least seven (7) years once you are no longer a Player with us unless there is another legal reason to retain your personal data longer. All data is securely stored for this time and safely deleted. 

Are there any more security precautions? 

Yes, not only do we implement appropriate technical and organisational measures to protect your personal data from unauthorised disclosure, use, alteration or destruction but a data protection risk assessment has been conducted which has reviewed all aspects of security in relation to Labour Lottery which will be reviewed annually. 

Our External Lottery Manager is certified to the UK Cyber Essentials scheme requirements and under Remote Gambling and Software Technical Standards – Security Requirements. This entails annual security audits based on sixty-one (61) relevant security controls of Annex A of ISO/IEC 27001:2013 security standard.  

Our External Lottery Manager (and therefore, for the Labour Lottery, Labour) maintain a suite of security related policies to maintain best practices and compliance to not only data protection requirements but UK gambling laws. 

The lottery platform is security tested on a regular basis throughout any given year and maintains security encryption and access standards to maintain high levels of security but also to maintain compliance with Licence Conditions and Codes of Practice (LCCP). 

We will always keep these under review to make sure that the measures we have implemented remain appropriate. Any personal data is not subject to any automated decision-making. 

Are there any more Cookies on the Lottery site? 

Yes, but we only process necessary and essential functional cookies on the Labour Lottery website. 

What are your rights and how can you express them? 

To understand your data privacy rights and to submit a rights request, the best way to do so is by visiting the ‘YOUR RIGHTS’ page on our website which you can get to by clicking here. 

How can you complain about our use your personal data? 

The best way to make a complaint is by visiting our page on ‘HOW TO MAKE A DATA PROTECTION COMPLAINT’ which you can access by clicking here.  

How can you contact us about this privacy notice? 

If you have any questions about the information in this privacy notice, then you can contact the Data Protection Team via email using [email protected] or by post within a letter to: 

Labour Statutory Data Protection Officer 

The Labour Party, Southworks, 20 Rushworth Street, United Kingdom, SE1 0SS 

When was this privacy notice last updated? 

We may update this notice (and any supplemental privacy notice), from time to time as shown below. We will notify you of the changes where required by applicable law to do so.