OITCOspreys in the Community

Legal

Privacy Policy

Effective from 1 March 2026 · Last updated 2 June 2026

1. Who we are

Ospreys in the Community(“we”, “us”), registered charity in England and Wales no. 1169850, is the data controller for personal data collected through ospreysinthecommunity.co.uk and the OITC Weekly Lottery. Our registered office is Swansea.com Stadium, Landore, Swansea SA1 2FA. Data protection queries go to our data protection lead at community@ospreysrugby.com.

2. What we collect

  • Supporter and donor details — name, contact details, donation history, and Gift Aid declarations (which we must keep for HMRC).
  • Lottery entrant details — name, contact details, chosen numbers, entry and subscription history, your 18+ confirmation, and any age or identity verification data collected before a prize is paid.
  • Payment and subscription data — handled by our payment provider, Stripe; full card details never touch our systems.
  • Contact form submissions and correspondence, including complaints.
  • Marketing preferences — kept separately from entries and donations; buying an entry is never treated as marketing consent.
  • Self-exclusion records — retained precisely so the exclusion can be enforced.
  • Website data — device and usage information collected through cookies and similar technologies.

3. How we use it

We use personal data to run the weekly draw and pay prizes; to take and administer donations and claim Gift Aid; to verify age and identity as the Gambling Act 2005 requires; to answer enquiries and handle complaints; to meet licensing, accounting and charity-law obligations; to operate safer-gambling protections, including maintaining and enforcing self-exclusion records and honouring marketing suppressions; and to send news and fundraising updates where you have consented.

  • Contract — processing entries, subscriptions and donations you ask us to take.
  • Legal obligation — age verification, licensing and accounting records, and Gift Aid records for HMRC.
  • Legitimate interests — service improvement, security and fraud prevention, balanced against your rights.
  • Consent — marketing emails and non-essential cookies; you can withdraw consent at any time.

5. Who we share data with

We share data only where needed to run the charity and the lottery: our payment processor (Stripe), IT, hosting and email providers, HMRC for Gift Aid, our auditors, and regulators — the Charity Commission, the Fundraising Regulator, the Gambling Commission or the local licensing authority — where required. We never sell personal data.

6. How long we keep it

Supporter records are kept only as long as we have a relationship with you plus any period the law requires. Entry, draw and prize records are retained for as long as lottery licensing and accounting rules require (six years from the end of the relevant financial year). Gift Aid declarations are kept for the period HMRC requires. Self-exclusion records are retained for the length of the exclusion and a period beyond it, so that the exclusion remains enforceable.

7. Winners’ details

We publish draw results in a privacy-safe format — first name, last initial and town only. Winners are always notified directly first, and any fuller publicity (a photo, a full name, a quote) happens only with the winner’s prior consent. We never publish a full name together with a full address.

8. Your rights

Under UK GDPR you can ask for access to your data, correction, erasure, restriction of processing, portability, and to object to processing based on legitimate interests; you can withdraw consent at any time; and you can complain to the Information Commissioner’s Office at ico.org.uk. To exercise any right, email community@ospreysrugby.com — choose “Data protection request” on the contact form.

9. Transfers, security and cookies

Data is stored in the UK or the European Economic Area wherever possible; any transfer outside the UK is protected by an adequacy decision or appropriate safeguards such as the UK International Data Transfer Agreement. We protect data with encryption in transit, access controls and staff training, and we review access regularly. This site uses essential cookies needed for it to work; any analytics or marketing cookies will be listed here, with a consent mechanism, before they are used.

10. Changes to this policy

We will update this page when our practices change and refresh the “Last updated” date above. Significant changes affecting lottery entrants or regular donors will be flagged by email.