Retailer Privacy Policy

• Personal and contact information when you register your interest in becoming a National Lottery retailer and/or become a National Lottery retailer (including as a result of buying a store that already sells National Lottery tickets), register on the retailer website (www.nationallotteryallstars.co.uk), or update any of your information with us, including your name, address, email address, telephone number(s), title, date of birth, gender, store name and address, retailer number and social media username(s) (if you contact us using social media). We may collect some of that contact information when you interact with us including via our Retailer Hotline and Telephone Sales Team.
• Your photograph when we visit your store.
• Details (and copies) of your communications and interactions with us via our Retailer Hotline, Telephone Sales Team or otherwise, including by email, telephone (voice recordings), post and on The National Lottery social media channels.
• Copies of documents you provide to prove your identity and address (including driving licence, passport, and utility bills) when you are in the process of becoming a National Lottery Retailer, or where there is a legal reason to request this from you.
• Transaction details including National Lottery ticket sales, payments of National Lottery prizes by you, payment of retailer commission to you, and any rewards you receive in any retailer incentive scheme.
• Your financial information including your bank account details – with supporting evidence, (which are sent to BACS) when you become a National Lottery retailer (and update that information with us).
• Technical information about your personal device or browser when you use the retailer website, including your internet protocol (IP) address, device ID, browser type and version and time zone setting, which may in some circumstances be personal data.
• We may also receive personal data directly from you or from various third parties and public sources, including from social media channels (if you interact with us through those channels), or other third parties including credit reference agencies.

In the table below, we set out all of the ways we use your personal data, and why. We have also identified what our legitimate interests are where appropriate.

It is sometimes necessary for us to process your personal data in order to enter into a contract with you, or to satisfy a contractual requirement (referred to as ‘performance of a contract with you’ below), or to comply with a statutory requirement. In those circumstances, if you do not provide the personal data we require, we will be unable to register you (or let you continue to operate) as a National Lottery retailer.

We use your personal data to create aggregated data sets. You are not identifiable from that aggregated data and it is not considered personal data.

However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Policy.

We sometimes share the data we collect from you with the following trusted third parties:

• Banks and payment providers – to enable payments to be collected from and made to you.
• Our IT system providers – in order to provide and repair / upgrade National Lottery equipment, software and systems to allow you to operate as a retailer and to allow on-site visits, and to communicate with you.
• Marketing agencies – for the purposes of sending you Jackpot magazine, and other marketing communications by post, on the retailer website or on social media.
• Printing agencies – for the purposes of sending you relevant content.
• Field service agencies – for the purposes of carrying out retailer visits and regulatory audits (including Operation Child visits).
• Engagement agencies – to provide and host our retailer website and manage the All Stars rewards process.
• Online survey companies and market research agencies – to undertake surveys (including for example, our retailer satisfaction survey) and other market research and to analyse the results.
• Digital analytics companies – for the purposes of website analytics and reporting in respect of our analytics and marketing.
• Public relations agencies – for the purposes of managing external communications about us and our winners and retailers.
• Professional advisers including lawyers, bankers, auditors and insurers – to enable them to provide consultancy, banking, legal, insurance and accounting services.
• The Gambling Commission – for legal and regulatory purposes as required under our licence to operate The National Lottery.
• Police or other such regulatory authority - as part of an investigation or otherwise for legal or regulatory purposes.
• Dispute Resolution agencies – for the purposes of dealing with any complaints and disputes.
• Credit reference agencies – for the purpose of checking your credit history during the process of becoming a retailer and whilst you are a retailer (for example if you miss a payment), and to comply with our insurance and regulatory obligations.
• Debt recovery agencies – for the purpose of recovering debts owed by you to us.
• Security companies – for the purposes of security, including prevention and detection methods, for the protection of The National Lottery.
• Auditors – to audit our systems and transactions for the purposes of ensuring efficiency, or regulatory or contractual compliance.
• UK law enforcement agencies and third party security companies – for the purposes of ensuring that we comply with the law and have adequate security measures in place.
• We will disclose your personal information to third parties if we are under a duty to disclose or share your personal data in order to comply with any legal or regulatory obligation or request. We do this in order to protect our rights, property or safety or those of our players, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
• In the event of another operator being awarded a future license to operate The National Lottery, there might be a transfer of retailer data from Camelot to the Gambling Commission and the new operator. If this happens, we will notify you of the transfer.

We have put various measures in place to protect your personal data:

• We are independently certified to a number of industry recognised standards, including ISO27001 which helps us maintain the highest levels of security across our entire business.
• We are a founding member of the World Lottery Association (WLA) and therefore comply with, and are regularly audited to, the WLA Security Control Standards for our gaming processes.
• Our retailer website is accessed using https rather than http, meaning that all information that is sent and received is encrypted for additional security. You can see this in the address bar of your browser.
• As described in this Privacy Policy, we may in some instances disclose your personal data to third parties. Where we do, we require that third party to have appropriate technical and organisational measures in place to protect your personal data; however in some instances we may be compelled by law to disclose your personal data to a third party, and have limited control over how it is protected by that party.
• The retailer website is regularly audited to ensure it meets our security requirements.

Your personal data may be processed outside the UK or European Economic Area (EEA) – including by staff operating outside the UK or EEA who work for us or for one of our third parties mentioned. That includes to the maintenance companies we use to repair our lottery terminals.

Where your personal data is transferred outside of the UK or EEA, we require that appropriate safeguards are in place. To find out more about the appropriate safeguards that we have in place, please contact us.

We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

At the end of that retention period, your data will either be deleted or anonymised (so that it can no longer be associated with you) for research or statistical purposes.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances you may be entitled to ask us to delete your data: see ‘Your rights’ below for further information.

You have the right:

• to ask us not to process your personal data where it is processed on the basis of legitimate interests, if there are no compelling reasons for that processing;
• to request from us access to personal information held about you (see below);
• to ask for the information we hold about you to be rectified if it is inaccurate or incomplete;
• to ask that we stop any consent-based processing of your personal data after you withdraw that consent;
• to ask, in certain circumstances, to delete the personal data we hold about you;
• to ask, in certain circumstances, for the processing of that information to be restricted;
• to ask, in certain circumstances, for data portability; and
• to ask us not to use your personal data for direct marketing, if we start sending direct marketing to you.

If you have any questions about our Privacy Policy, including any requests to exercise your rights, please contact the Data Protection Officer using the details set out below:

By post to:

Data Protection Officer
Camelot UK Lotteries Limited
Tolpits Lane
Watford
Hertfordshire
WD18 9RN

By email to:

dpo@national-lottery.co.uk

In order to request a copy of the personal data that Camelot holds about you, please send your request by post in writing to the Data Protection Officer at the above address. To enable us to verify your identity and process your request, you must include all of the following information and documentation with your request:

• your full name and retailer number;
• a description of the data that you are requesting, including a date range;
• a copy of your current and valid photo ID (e.g. passport photo page);
• proof of your address in the form of a photocopy of a utilities or service provider bill;
• the date of the request; and
• if your request relates to the retailer website, the email address registered to your All Stars account.

If you are unhappy with our processing of your personal data, you have the right to complain to the Information Commissioner’s Office (ICO) at any time. The ICO’s contact details are available here: https://ico.org.uk/concerns/. We would, however, appreciate the chance to deal with any concerns before you approach the ICO, so please contact the Data Protection Officer by email in the first instance.

We use cookies and similar technologies to recognise you, your browser and your device. We also allow certain third parties to use cookies and pixels while you are on the retailer website, which collect information about your browsing habits and usage.

There are four main types of cookies and technology. Here's how and why we use them:

Strictly necessary cookies

These are cookies that are required for the operation of our retailer website. Without these cookies, you will not be able to use some functionality on our website, such as signing into your All Stars account.

Performance cookies

These cookies collect information about how you use the retailer website and help us improve the way our retailer website works.

Functionality cookies

These cookies allow us to identify whether you are logged into your All Stars account and to remember choices you make, in order to improve your experience of the retailer website.

Advertising cookies and pixels

Our partners place third party cookies and pixels onto the retailer website on our behalf. These cookies record your visit to the retailer website and the pages you have visited. We use this information to make the retailer website more user friendly. You can opt out of these cookies but doing so may affect your use of the retailer website. More information about these types of cookies and opting out information can be found in Manage your cookies.

Below is a list of our partners that may place cookies, pixels or other similar technology on your browser or device when visiting our retailer website:

For more information about cookies, how to opt out and the steps you can take to protect your privacy on the internet, go to http://www.youronlinechoices.com/uk/ – the guide to online behavioural advertising and privacy. This website is operated by the Internet Advertising Bureau, the industry body for online advertising. On here you'll find information about how behavioural advertising works, how to opt out, further information about cookies and the steps you can take to protect your privacy on the internet.

If you'd prefer to restrict, block or delete cookies from the retailer website, you can do so in your browser settings. If you choose to disable cookies, then please note that this may limit the way you use the retailer website. For example, you may have to re-enter information that would have ordinarily been stored as a cookie.

How to control cookies on your desktop:

Internet Explorer cookies information

Safari cookies information

Chrome cookies information

Firefox cookies information

Opera cookies information

How to control cookies on your mobile device:

Apple iOS Safari

Android Chrome