Privacy Policy

Dementia Lottery Scotland · Effective from publication date · This is the controlling, English-language version.

1. Who we are (the “data controller”)

The Dementia Lottery is operated by Dementia Drive CIC, a Scottish Community Interest Company (company number SC861664). Dementia Drive CIC is the “data controller” for the personal data described in this policy under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact for data queries: [email protected]
Registered office: as filed at Companies House under SC861664.

2. The personal data we collect

We deliberately collect the minimum data needed to run the lottery and contact you if you win. Specifically:

We do not collect payment-card data on our website. Tickets are sold in person only, in cash or by other arrangements managed by the vendor at the point of sale.

3. The lawful bases on which we rely

Under UK GDPR we must have a lawful basis for processing your personal data. We rely on the following:

• Performance of a contract (Article 6(1)(b)): Once you buy a ticket and register your entry, there is an effective contractual relationship between you and Dementia Drive CIC to enter you into the draw and to notify you of the result. We need your contact details and ticket number to fulfil that contract.
• Legal obligation (Article 6(1)(c)): We are required by the conditions of our Small Society Lottery licence and by HMRC and anti-money-laundering rules to keep certain records of entries, prize awards and beneficial recipients for defined periods.
• Legitimate interests (Article 6(1)(f)): We rely on our legitimate interests to verify entries, prevent fraud and abuse of the lottery, and to operate our website securely.
• Consent (Article 6(1)(a)): Where you have ticked the marketing opt-in, we rely on your consent to send you occasional community updates by email or SMS. You can withdraw your consent at any time (see Section 8 below).

4. Who we share your data with

We do not sell your personal data, and we do not share it with third parties for their own marketing. We share the minimum necessary with the following categories of recipient:

• Our website and CRM platform provider: HighLevel (LeadConnector) hosts our website, forms and contact records. They act as a data processor on our written instructions.
• Our SMS and email delivery providers: Used to send the draw link and any communications you have consented to.
• Our licensing local authority and regulators: If lawfully required, we will share specific records with our Scottish licensing local authority, the Gambling Commission, HMRC, the Information Commissioner’s Office (ICO), or a court order.
• Dispute-resolution providers: If a dispute relating to the lottery itself is escalated to an approved Alternative Dispute Resolution provider (for example, the Independent Betting Adjudication Service — IBAS), we will share the records necessary to resolve it.
• Professional advisers: Our solicitors, accountants and auditors, only where strictly necessary and bound by confidentiality.

5. International transfers

Some of our service providers (notably HighLevel/LeadConnector) are based outside the United Kingdom. Where personal data is transferred outside the UK, we rely on the UK’s International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision, to ensure your data is protected to an equivalent standard.

6. How long we keep your data

We do not keep your data for longer than necessary. Our standard retention periods are:

• Entry and draw records: retained for at least the period required by our Small Society Lottery licence and HMRC (typically 6 years after the financial year in which the draw took place), then securely deleted.
• Marketing contact details (where consent was given): retained until you withdraw consent, after which they are removed from our active marketing lists.
• Records of disputes or refunds: retained for up to 6 years after resolution to defend potential claims.
• Anonymised analytics: retained indefinitely once stripped of identifying information.

7. How we keep your data secure

We use technical and organisational measures appropriate to the sensitivity of the data we hold — including encryption in transit, restricted-access cloud storage, access controls, multi-factor authentication for staff and processors, and routine review of who can access what. No system is ever 100% secure, but we treat your data with care and we will notify you and the ICO where a breach is likely to result in a high risk to your rights.

8. Your rights under UK GDPR

You have the following rights in relation to your personal data:

• Right of access: to ask for a copy of the personal data we hold about you.
• Right to rectification: to ask us to correct inaccurate or incomplete data.
• Right to erasure (the “right to be forgotten”): to ask us to delete your data, subject to our legal obligations to retain certain records.
• Right to restrict processing: in specific circumstances.
• Right to data portability: to receive a portable copy of the data you provided to us.
• Right to object: to processing based on legitimate interests, and to direct marketing at any time.
• Right to withdraw consent: where we rely on your consent (for example, marketing). Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew it.
• Right to complain to the ICO: if you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We’d ask you to contact us first so we can try to resolve it directly.

To exercise any of these rights, please email us at [email protected]. We will respond within one calendar month.

9. Marketing communications

We will only send you marketing communications if you have given specific consent (for example, by ticking the opt-in box on the entry registration form). Every marketing email contains a one-click unsubscribe link, and every marketing SMS supports STOP-to-unsubscribe. We honour unsubscribe requests immediately.

10. Cookies and similar technologies

Our website uses a small number of essential cookies to operate forms securely and to remember your preferences. We do not use third-party advertising or cross-site tracking cookies. If we ever introduce analytics or marketing cookies, we will update this policy and obtain your consent through a cookie banner before they are set.

11. Children

You must be aged 16 or over to enter the Dementia Lottery. We do not knowingly collect personal data from anyone under 16. If we identify an entry from a person under 16, we will refund the ticket, direct the funds to the cause, and securely delete the personal data submitted.

12. Changes to this policy

We may update this Privacy Policy from time to time — for example, to reflect changes in our operations, our providers, or the law. The current version is always available at this URL, and the effective date at the top of the page tells you when it was last updated.

13. Contact

If you have any questions, concerns or requests in relation to this Privacy Policy or your personal data, please contact:

Data Controller: Dementia Drive CIC (SC861664)
Email: [email protected]
Post: as registered at Companies House under company number SC861664