Last updated 19.01.2024
Last updated 19.01.2024
Premier Lotteries Ireland DAC (PLI) is the operator of the Irish National Lottery. PLI was awarded a 20-year licence to operate the National Lottery by the Irish Government in February 2014 and commenced operations in November 2014. PLI is based in the National Lottery headquarters building on Abbey Street Lower, Dublin 1.
PLI is the controller of personal data collected and processed from visitors and players using the National Lottery’s website and apps.
This Data Privacy Statement is designed to demonstrate our firm commitment to privacy and to inform you of the personal data that we collect and process in connection with your use of the National Lottery website and apps.
It also sets out details of what personal data we process, why we process it, with whom your personal data is shared, and a description of your rights with respect to your personal data.
This Data Privacy Statement will be reviewed from time to time to take into account ongoing developments at the National Lottery and any changes in the law.
To comply with our obligations under the National Lottery Act 2013, which includes an obligation to prevent underage or problem play, we will collect and process information about you referred to in this Data Privacy Statement as ‘personal data’.
This personal data will include your on-site activity, your account registration details and all transactional details. If you become a player and you later close your account, we are required by the Licence to Operate the National Lottery (“Licence”) to maintain a record of your account so we can meet our legal and regulatory obligations.
Your personal data is primarily obtained directly from you at the point of player registration or while you browse the website and when you play.
In addition, our website uses cookies to distinguish you and your preferences from other users of the site. This helps us to improve your experience when you browse our website and also allows us to improve the user journey. Follow this link to our Cookie Policy to find out more. The Cookie Policy should be read in conjunction with this Data Privacy Statement as the same data protection rights apply to cookies.
The categories of personal data we process, and the lawful bases for doing so, are set out in the Details of Processing Activities section of this Data Privacy Statement.
The personal data we hold, process and retain will be used for the management of your account, for administrative purposes, for meeting our legal and regulatory obligations, for ensuring responsible play, and for marketing. We hold it and use it to protect your rights and interests and to manage our relationship with you appropriately, effectively and lawfully. At the same time, it enables us to run our business.
This includes using your personal data to enable us to manage your registration, comply with our legal obligations, pursue our legitimate interests and protect ourselves in the event of legal proceedings.
The uses we make of each category of your personal data, together with the lawful bases we rely on for those uses are set out in more detail in the Details of Processing Activities section of this Data Privacy Statement.
Where there is a need to process your data for a purpose other than those set out at the end of this Data Privacy Statement, or otherwise outlined to you, we will inform you of this and, if required, we will seek your consent.
If you do not wish to open an online account, but wish to participate in retail promotions which require you to enter limited personal data online, this data will be treated in the same manner as set out in this Data Privacy Statement.
If you do not wish to share the personal data required during the registration process, unfortunately you will not be able to use the online services to play National Lottery games.
PLI is certified to the ISO 27001 standard for Information Security Management Systems, and to the World Lottery Association (WLA) Security Control Standard, for the purpose of protecting the confidentiality, integrity and availability of your personal data.
Your personal data may be disclosed to third parties where we are legally obliged to do so.
It will also be disclosed during activities where we have lawful contractual agreements in place that enable us to operate the National Lottery.
Your personal data will also be disclosed to third parties where we have a lawful legitimate interest to share your data, such as in marketing campaigns, provided that you have agreed to receive marketing information.
Your contact details will also be shared with research companies for the purposes of conducting surveys relating to responsible play and gambling awareness.
Again, you will find more detailed information on how we share your personal data with third parties, and who they are, in the Details of Processing Activities section of this Data Privacy Statement.
The main country storage location of your personal data is Ireland.
We will transfer your personal data to other companies within the EEA for purposes connected with the enhancement of your online experience.
Your personal data will be transferred outside of the EEA during the provision of certain services which are managed and provided by third parties. Recognised data protection safeguards are in place to ensure the security of your personal data where it is transferred outside of the EEA.
Further details are provided in the Details of Processing Activities section of this Data Privacy Statement.
Under the terms of the Licence, PLI has certain data retention requirements which amount to a legal obligation. The personal data retention periods applied by PLI are outlined in the Abridged Data Retention Policy at the end of this Data Privacy Statement.
Should you choose to close your account, you can re-open it by contacting the National Lottery. You cannot create a new account unless you first submit a Data Deletion request to: DPO@Lottery.ie or by contacting Customer Support here: https://www.lottery.ie/about/contact-us.
The National Lottery is required to operate an effective responsible play programme. If you choose to create an online account and, at a later date, decide to permanently self-exclude yourself from further play, or if the Player Protection team decides to permanently exclude you from further play, your account will be frozen and retained until the end of the Licence agreement in 2034, plus two years.
For further information regarding other mandatory data retention periods, please refer to the Abridged Data Retention Policy at the end of this Data Privacy Statement.
In line with the interests outlined in the information provided in the Details of Processing Activities section of this Data Privacy Statement, and to comply with the legal obligations of our licence, we carry out profiling and analysis based on your location data, age, gameplay activity (frequency of days played, spend limit hits, types of games played), interests and behaviours for the following purposes:
During the process to create a new account, all information supplied during registration will be scanned against existing accounts – open, recently closed, excluded, self-excluded, suspended and fraudulent – to ensure that a person cannot open more than one account.
No player will be subject to automated decision-making without a holistic review being performed by highly skilled professionals who are responsible for preventing problem play. For more information, please visit our dedicated page at https://www.lottery.ie/useful-info/play-responsibly.
You have the following rights under data protection law, although your ability to exercise these rights may be subject to certain conditions and where we are permitted to do so under the terms of the Licence.
You can contact PLI’s Data Protection Officer at DPO@lottery.ie or by calling the National Lottery on (01) 889 1000.
PLI uses a secure system for handling rights requests, which is provided by a specialist service provider called OneTrust. If you would like to exercise any of these rights, please contact us via our Data Subject Rights Request link.
Personal data processed
Gender, name, preferred greeting, address, email address, phone number, date of birth, proof of ID, IP address, date and time of registration, payment card, browser, mother’s maiden name, place of birth, emailing preferences, URLs visited, referral URLs, biometric facial image scan versus supplied ID including temporary capture of all fields of the supplied ID.
Purpose for processing and uses of the data
To give you access to the National Lottery website and to distinguish you and your preferences from other users of the site, our website places a combination of Strictly Necessary cookies and other cookies that first require your consent, on your PC or mobile device.
To register as a National Lottery online player in compliance with legal and regulatory requirements such as living in Ireland and over 18, and to ensure responsible play.
To verify your identity comparing the proof of ID supplied versus the information you provide during registration.
To enable your ability to play, PLI requires the storage of your payment card with a specialist card processing company. PLI will only receive limited hashed card details.
To compare your facial features versus a supplied ID image, when the face match/liveness feature is enabled and you provide your consent, in order to verify that you are the rightful owner of the supplied ID image.
To send weekly results, inform you of large jackpots, to provide information about offers and promotions, when you provide consent for such communications.
Lawful basis for processing the data
Contractual and legal obligations: The processing of data is necessary to enter into a contract with PLI and to meet the legal and regulatory requirements of the National Lottery Act and the Licence. If the player does not provide the requested data, including a state-issued ID document, PLI will not be able to complete the player registration.
Consent:
Legitimate interest (prior to registration):
Sharing of personal data
PLI shares personal data with:
Personal data processed
Gender, name, preferred greeting, address, email address, date of birth, proof of ID, IP address, date and time of visit, payment card, browser, mother’s maiden name, place of birth, emailing preferences, URLs visited, referral URLs, games played, number played, amounts played, amounts added, amounts withdrawn, wallet amount, page, length of visit, cookies, biometric facial image scan versus supplied ID including temporary capture of all fields of the supplied ID.
Purpose for processing and uses of the data
To give you access to the National Lottery website and to distinguish you and your preferences from other users of the site, our website places a combination of Strictly Necessary cookies and other cookies that first require your consent, on your PC or mobile device.
To play online National Lottery games in compliance with legal and regulatory requirements such as living in Ireland and over 18, and to ensure responsible play.
To verify your identity comparing the proof of ID supplied versus the information you provide during registration. All players, irrespective of the date when the account was opened, are required to verify their identity, should they wish to add funds to their account.
To compare your facial features versus a supplied ID image, when the face match/liveness feature is enabled and you provide your consent, in order to verify that you are the rightful owner of the supplied ID image.
To enable your ability to play, PLI requires the storage of your payment card with a specialist card processing company. PLI will only receive limited hashed card details.
To tailor your experience on our digital channels, to improve email marketing activity, and to suggest relevant marketing content.
To send weekly results, to inform you of large jackpots, to provide information about offers and promotions, when you provide consent for such communications.
To create statistics to enable PLI to develop responsible play initiatives and player protection controls such as spend limits and monitoring of account exclusions.
To conduct player satisfaction and market research surveys, including surveys relating to responsible play and gambling awareness.
Lawful basis for processing the data
Contractual and legal obligations: The processing of data is necessary to enter into a contract with PLI and to meet the legal and regulatory requirements of the National Lottery Act and the Licence. If the player does not provide the requested data, PLI will not be able to allow the player to play National Lottery games online. If you already hold an online account and do not wish to undergo the ID verification process when asked to do so, you may no longer be permitted to access your account and it may be closed after a period of time.
Consent:
Legitimate interest:
To Opt-Out of Responsible Play Surveys please email opt_out@lottery.ie
(Note: there is an underscore between ‘opt’ and ‘out’ – opt_out)
Sharing of personal data
Personal Data is shared with the same organisations as outlined in the Player Registration section above.
PLI shares email address, first name, surname, telephone number, age and gender with third party research companies, such as RED C Research, who carry out player satisfaction surveys, market research surveys, and surveys relating to responsible play and gambling awareness on PLI’s behalf.
Third party research companies will only hold your personal data for six months.
RED C Research’s privacy notice may e viewed here:
https://redcresearch.ie/privacynotice/
PLI may share players’ data with FTI Consulting Management for running automated checks to discover duplicate accounts and to improve the checking algorithms employed.
Personal data processed
Geo-location, name, IP address, phone device ID, device IMEI, platform, purchase total, device OS version
Purpose for processing and uses of the data
Location is required to comply with legal requirements (living in and playing from Ireland).
Lawful basis for processing the data
Contractual and legal obligations: The processing of data is necessary to enter into a contract with PLI and to meet the legal and regulatory requirements of the National Lottery Act and the Licence. If a player does not provide the requested data, PLI will not be able to allow the player to play National Lottery games online.
Consent: Direct marketing activity is subject to player consent. The player has the clear option to opt-in to receive marketing communications at the point of registration and then to opt-out at any time.
Push Notifications are messages which are sent from the National Lottery mobile app to users who have downloaded the National Lottery App and have opted-in to receive notifications. These notifications can be considered to be both service and marketing in nature. You have the ability to enable or disable push notifications from the National Lottery mobile app on your phone or device at any time. Here’s how:
If you are using the National Lottery mobile app on an iOS device, you will be automatically prompted to opt in or to opt out of push notifications when you install the app.
If you are using the National Lottery mobile app on an Android device, you will be automatically opted-in to receive push notifications when you install the app. This is normal for Android devices.
You can disable notifications by changing the settings for the App on your mobile device.
Android Phones: Go to settings and select 'Apps'. Tap on the National Lottery App and then select 'Notifications'. You will be given the option to block all notifications from the app.
Apple Phones: Go to Settings, tap on Notifications and select the National Lottery App. You will see the option to allow or disable notifications for the app.
Legitimate interest:
Sharing of personal data
Personal Data is shared with the same organisations as outlined in the Player Registration and Ongoing Player Interaction sections above.
Personal data processed
Gender, name, preferred greeting, address, email address, date of birth, proof of ID, IP address, date and time of visit, payment card, browser, mother’s maiden name, place of birth, games played, numbers played, amounts played, amounts added, amounts withdrawn, wallet balance, length of visit, biometric facial image scan versus supplied ID including temporary capture of all fields of the supplied ID, X (twitter) account, Facebook Messenger account, Instagram account, telephone number, telephone call recordings, instant messages, web chat.
Purpose for processing and uses of the data
To provide assistance to players and to monitor quality of services.
Lawful basis for processing the data
Contractual and legal obligations: The processing of data is necessary to enter into a contract with PLI and to meet the legal and regulatory requirements of the National Lottery Act and the Licence.
If the player does not provide the requested data, PLI will not be able to provide player support.
Sharing of personal data
PLI shares personal data with:
Personal data processed
Data collected on the claim form: name, address, date of birth, telephone number, proof of ID (type and expiry date) and signature.
Data collected on a voluntary basis: gender, occupation, and consent for publicity (photographs, video, name, address and any other information as agreed in writing).
Purpose for processing and uses of the data
To comply with legal and regulatory requirements (such as, winner is over 18).
To facilitate the redemption of draw based games and scratch card prizes as described in the Game Rules.
Lawful basis for processing the data
Contractual and legal obligations: The processing of data is necessary to enter into a contract with PLI and to meet the legal and regulatory requirements of the National Lottery Act and the Licence. If the player does not provide the requested data, PLI will not be able to pay the player.
Consent: Publicity material is processed on the basis of consent. If consent is subsequently withdrawn, PLI will cease to process this information. However, if this information has been shared with third parties (i.e. the media), PLI will no longer be in control of this data and cannot restrict further processing which is already in the public domain.
Gender and occupation information is gathered on a voluntary basis and used purely for statistical purposes.
Sharing of personal data
Personal data is not generally shared with third parties, unless the game type has stipulated the use of third-party providers to facilitate the redemption of game prizes, such as the annuity game EuroDreams.
The claim form is kept in secure storage for a period of up to two years and the data supplied therein is retained electronically for the duration of the Licence plus two years.
If the player, or syndicate, consents to publicity, the name, winnings and imagery may be published on the National Lottery website, via email and social channels and shared with the media (newspapers, radio and/or television stations) as agreed in writing. It will also be archived for future “throwback” marketing purposes.
Once the information has been shared with the media, the information will be in the public domain and PLI will not be able to enforce deletion.
PLI shares personal data with:
Mercer for overseeing the establishment of the annuity policy between the EuroDreams prize winner and Irish Life. Mercer will act as an insurance intermediary and gather all the necessary information, as described in the game rules, to set up an annuity policy and to satisfy Anti Money Laundering requirements.
Irish Life for setting up the annuity policy for EuroDreams prize winners. Irish Life will be responsible for managing the purchased annuity policy and for handling winners’ data subject rights requests. Irish Life’s privacy notice may be found here: https://www.irishlife.ie/ila-privacy-notice/
Hampers & Co for facilitating the redemption of prizes for Hampers & Cash winners. PLI will share prize winners’ name, address, and contact number with Hampers & Co, who then contact them to arrange for the prizes to be chosen and sent out. Please see here an overview of Hampers & Co privacy policy: https://hampersandco.com/pages/our-privacy-policy
Personal data processed
Scratch card draw entries: name, address, email address, telephone number and signature.
TV Game Show participants and proxy participants: name, address, date of birth, phone number, signature and type of ID; proxy participant’s name, address & phone number; photographic and TV broadcast imagery.
Beneficiaries of National Lottery funding: video footage of Good Cause funding recipients and their projects.
Purpose for processing and uses of the data
To claim scratch card prizes above a certain value as described in the Game Rules.
To participate on the TV Game Show, or to allow a nominated proxy to participate instead, and for winners to receive prizes.
To publicise the benefits and beneficiaries of Good Cause funding raised by the National Lottery.
Lawful basis for processing the data
Contractual and legal obligations: The processing of data is necessary to enter into a contract with PLI and to meet the legal and regulatory requirements of the National Lottery Act and the Licence. If the player does not provide the requested data, PLI will not be able to pay the player. If a potential participant of the TV Game Show does not provide the requested data, the potential participant will not be able to take part in the TV Game Show.
Consent: Publicity material is processed on the basis of consent. Once the information has been released to the media, PLI would not be able to fulfil requests to withdraw consent.
Sharing of personal data
PLI shares personal data with:
Personal data processed
Name, address, date of birth, telephone number, email address, IP address
Purpose for processing and uses of the data
To register a retail or online National Lottery Player’s entry into a second chance draw in compliance with legal requirements (such as, over 18).
To send information about offers and promotion.
The information is used internally by the National Lottery's digital marketing team.
Lawful basis for processing the data
Contractual and legal obligations: The processing of data is necessary to enter into a contract with PLI and to meet the legal and regulatory requirements of the National Lottery Act and the Licence. If the player does not provide the requested data, PLI will not be able to complete the player registration for the relevant second chance draw.
Consent: Direct marketing activity is subject to player consent. The player has the clear option to opt-in to receive marketing communications at registration time and then to opt-out any time.
Sharing of personal data
PLI shares personal data with:
The National Lottery was set up with the express purpose of raising funds for Good Causes, with almost 30 cent of every €1 our players spend on National Lottery games going to Good Causes.
Funds raised by the National Lottery are transferred to the Exchequer and are used to part-finance expenditure by various Government Departments on projects in these categories: Sport, Health, Community, Children & Youth, Arts, Heritage & Irish Language.
Each Government department or body accepts applications for funding on an annual basis and disperses grants accordingly. Each Government department then shares this information with the National Lottery so that we can inform our Players as to what organisations, clubs, voluntary groups etc have received National Lottery Good Causes funding.
Personal data processed
In addition to the name of the voluntary organisation or group, the grant amount and grant purpose, the following personal data is processed: name, address, landline & mobile telephone number, email address, IP address, photographic & videographic imagery.
Purpose for processing and uses of the data
The data will be used to contact and seek permission from certain organisations, groups and sport clubs all over Ireland to enable the National Lottery to create and produce photographic and video stories, including promotional material, that will recognise the inspiring and innovative work being carried out.
These stories may be used, with the consent of those involved, as part of our marketing activities and promoted across our consumer touchpoints e.g. Social, Online, National Lottery App, TV, Radio, Retail & PR communications.
The data is also used to contact and respond to Good Cause Awards entrants as appropriate.
At the Good Causes Award event, photography, videography and soundbites of attendees and winners will be captured to showcase the awards ceremony.
The data is also used to enable the National Lottery to print and distribute personalised signage to Sports Clubs and organisations around the country, to acknowledge funding received through the Sports Capital Programme Grant, which is part-funded by National Lottery Good Causes..
Lawful basis for processing the data
Legitimate interest: To inform and educate our players as to where the Good Causes funding goes and highlight the impact this funding has on the various voluntary groups and communities. Also, the processing of data is necessary to enter the Good Cause Awards competition which the company has a legitimate interest in promoting. Any content captured on the night of the Good Causes Awards is also used to promote the winners of the Good Causes Awards and drive awareness of Good Causes.
Balance of data subjects’ interest: Recognition and awareness of the work being carried out by Good Cause beneficiaries; data subjects have the right to opt out and not take part in promotion of good causes and do not have to enter the Good Causes Awards competition; data subjects have the right to be removed from databases relating to these promotions. However, where photographs, videos and soundbites from the Good Causes Awards ceremony have already been released into the public domain, it may not be possible to have them deleted at that stage.
Sharing of personal data
PLI shares personal data with:
For Lottery winners who agree to take part in advertising and promotional campaigns, telling their personal stories.
Personal data processed
Name, address, landline and/or mobile telephone number, email address, IP address, social media accounts, ticket winning information, imagery – both photographic & video, voice recordings, video recordings.
Purpose for processing and uses of the data
The data will be used as part of the National Lottery’s marketing activities and will be promoted across a variety of media and consumer touchpoints. Examples of these consumer touchpoints include but will not be limited to TV, Radio, Outdoor, Online, Social, Retail, PR.
Winners’ stories will also be used internally by the National Lottery in communications such as our internal newsletters. They will also be included on our Retailer portal, the National Lottery access point for our retail partners.
Lawful basis for processing the data
The processing of this data will be obased on consent. Winners are entitled to withdraw the consent to which PLI will fulfil by stopping marketing communications using their data. Once the information has been released to the media, PLI would not be able to fulfil requests to erase the data that will be publicly available.
Sharing of personal data
PLI shares personal data with:
“Licence” means Licence to Operate the National Lottery, 27.02.2014.
Information Type |
Retention Period |
|
Good Cause Photos/Images |
Duration of Licence plus 2 years after termination in accordance with Clause 15.3 of Licence |
|
Winning Streak - Winners Bio's |
1 year |
|
Winner Images |
Duration of Licence plus 2 years |
|
Winning Streak PR Release Forms; |
Duration of Licence plus 2 years |
|
Winner’s information and prize values |
Duration of Licence plus 2 years |
|
General online player information (including name, address, date of birth, email, phone) |
Duration of Licence plus 2 years |
|
Online Player Transactions |
Details of transactions: |
|
Users who sign up for promotion / competitions but never play online; (name, email address and phone number) |
Delete within 3 months after promotion/competition ends |
|
Customer Care interactions |
Open Account: Indefinite |
|
Call recordings Customer Care interactions |
7 years |
|
Emails Customer Service contact for Players |
Delete within 12 months on closure of account. |
|
Biometric facial image scans and copies of supplied IDs |
31 days max |
|
Data Subject Rights Request records |
7 years | |
Daily check for duplicated accounts |
Duration of Licence plus 2 years |
|
Good Causes Awards entrant information |
13 months |
|
Win Awareness – Real Winners Stories |
Duration of Licence plus 2 years |
|
Second Chance Database |
12 months |