Data Privacy Statement of PLI

Premier Lotteries Ireland DAC (PLI) is the operator of the Irish National Lottery. PLI was awarded a 20-year licence to operate the National Lottery by the Irish Government in February 2014 and commenced operations in November 2014.

PLI uses Camelot Global Services Limited (CGS), a sister company, to manage our digital channels, customer services and IT requirements.

PLI and CGS are based in the same premises at National Lottery, Abbey Street Lower, Dublin 1.

PLI is the controller of personal data collected and processed from visitors and players using the National Lottery’s website and apps.

This Data Privacy Statement is designed to demonstrate our firm commitment to privacy and to inform you of the personal data that we collect and process in connection with your use of the National Lottery website and apps.

It also sets out details of what personal data we process, why we process it, with whom your personal data is shared, and a description of your rights with respect to your personal data.

To comply with our obligations under the National Lottery Act 2013, which includes an obligation to prevent underage or problem play, we will collect and process information about you referred to in this Data Privacy Statement as ‘personal data’.

This personal data will include your account registration details and your on-site activity including transactional details. If you become a player and you later close your account, we are required by our licence to maintain a record of your account so we can meet our legal and regulatory obligations.

Your personal data is primarily obtained directly from you at the point of player registration or while you browse the website and when you play.

The categories of personal data we process, and the lawful bases for doing so, are set out in detail at the end of this Data Privacy Statement.

The personal data we hold, process and retain will be used for the management of your account, for administrative purposes, for meeting our legal and regulatory obligations and for marketing. We hold it and use it to protect your rights and interests and to manage our relationship with you appropriately, effectively and lawfully. At the same time, it enables us to run our business.

This includes using your personal data to enable us to manage your registration, comply with our legal obligations, pursue our legitimate interests and protect ourselves in the event of legal proceedings.

The uses we make of each category of your personal data, together with the lawful bases we rely on for those uses are set out in more detail at the end of this Data Privacy Statement.

Where there is a need to process your data for a purpose other than those set out at the end of this Data Privacy Statement, or otherwise outlined to you, we will inform you of this and, if required, we will seek your consent.

If you do not wish to open an online account, but wish to participate in retail promotions which require you to enter limited personal data online, this data will be treated in the same manner as set out in this Data Privacy Statement.

If you do not wish to share the personal data required during the registration process, unfortunately you will not be able to use the online services to play National Lottery games.

Your personal data may be disclosed to third parties where we are legally obliged to do so.

It will also be disclosed during activities where we have lawful contractual agreements in place that enable us to operate the National Lottery.

Your data will also be disclosed to third parties where we have a lawful legitimate interest to share your data, such as in marketing campaigns, provided that you have agreed to receive marketing information.

Again, you will find more detailed information on how we share your personal data with third parties, and who they are, at the end of this Data Privacy Statement.

The main storage location for your personal data is in Ireland.

We will transfer your personal data to other companies within the EEA for purposes connected with the enhancement of your online experience.

Your personal data will be transferred outside of the EEA during the provision of certain services which are managed and provided by third parties. Recognised data protection safeguards are in place to ensure the security of your personal data where it is transferred outside of the EEA.

Further details are provided at the end of this Data Privacy Statement.

Any personal data that we collect, process and hold about you is retained only for as long as it is required.

However, under the licence to operate the National Lottery, PLI is required to keep certain records, such as financial transactions and the personal data associated with that, for a period of two years after the end of the licence agreement.

For further information regarding mandatory data retention periods, please refer to our Abridged Data Retention Policy at the end of this Data Privacy Statement.

In line with the interests outlined in the information at the end of this Data Privacy Statement, or to comply with the legal obligations of our licence, we carry out profiling and analysis based upon your location data, age, gameplay activity, interests and behaviours for the following purposes:

• To comply with our legal and regulatory obligations such as preventing underage or problem play, prevention of money laundering, prevention of fraud and to ensure the integrity and security of the National Lottery.
• To offer you tailored products and services, and more relevant marketing, such as bringing to your attention similar games to the ones you like to play.

You have the following rights under data protection law, although your ability to exercise these rights may be subject to certain conditions and where we are permitted to do so under the terms of our licence to operate the National Lottery.

• Information Request. The right to receive a copy of and/or access the personal data that we hold about you, together with other information about our processing of that personal data.
• Update Data. The right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update your data such that it is complete.
• Data Deletion. The right, in certain circumstances, to request that we erase your personal data.
• Restrict Processing. The right, in certain circumstances, to request that we no longer process your personal data for particular purposes.
• Object to Processing. The right to object to our use of your personal data or the way in which we process it.
• Data Portability. The right, in certain circumstances, to transfer your personal data to another organisation.
• Review Automated Decisions. The right to object to automated decision making and/or profiling.
• File a Complaint. You have the right to complain to the Data Protection Commissioner. You also have the ability to complain to us via our Subject Access Request link – choose option ‘File a Complaint’.
  
  PLI uses a secure system for handling access rights requests, which is provided by a specialist service provider called OneTrust. If you would like to exercise any of these rights, please contact us via our Subject Access Request link.

Player Registration

Personal data processed

Gender, name, preferred greeting, address, email address, date of birth, proof of ID, IP address, date and time of registration, credit or debit card, browser, mother’s maiden name, place of birth, emailing preferences, URLs visited, referral URLs.

Purpose for processing and uses of the data

To register a National Lottery Player in compliance with legal & regulatory requirements (living in Ireland, over 18 and responsible player).

To enable your ability to play, PLI requires the storage of your credit or debit card with a nominated third party".

To send weekly results, inform of large jackpots, to receive information about offers and promotions.

Lawful basis for processing the data

The processing of data is necessary to enter into a contract with PLI and to meet the legal and regulatory requirements of the National Lottery Act and the Licence to Operate the National Lottery. If the player does not provide the requested data, PLI will not be able to complete the player registration.

Direct marketing activity is subject to player consent. The player has the clear option to opt-in to receive marketing communications at registration time and then to opt-out any time.

Sharing of personal data

PLI shares personal data with:

• Camelot Global Services (CGS): management of PLI digital channels, customer care, IT.
• Global Payments (formerly Realex Payments) to process your debit/credit card on behalf of PLI. Global Payments fully comply with the PCI/DSS 3.2 security requirements.
• HubSpot for marketing campaigns. HubSpot store personal data outside the EEA, in the USA. (EU-US Privacy Shield)
• Cloudflare to protect the National Lottery’s websites against DDoS attacks (Distributed Denial of Service, a type of hacking). This requires personal data to transit through Cloudflare’s infrastructure. This takes place in multiple locations both inside and outside the EEA (for transfers to the USA, EU-US Privacy Shield). The traffic through Cloudflare is fully-encrypted.
• Google Analytics to measure the traffic on the National Lottery’s websites. See here for an overview of privacy at Google: (EU-US Privacy Shield and https://support.google.com/analytics/answer/6004245)
• Display Media - DoubleClick (a Google product) offers technology products and services that are sold to Core Media (a nominated third party advertising agency) to allow the National Lottery to deploy, target, deliver, and report on interactive advertising campaigns.
• Social Media - Audiences are set up on the National Lottery Facebook account based on HubSpot CRM (Customer Relationship Management) data. National Lottery also uses these audiences to market to other potential customers.
• Kochava - Provides real-time attribution and analytics mobile tracking. It has integration with over 2,000 networks and publishers. Kochava is linked with DoubleClick to record the amount of downloads that are happening via National Lottery app campaigns supporting both iOS and Android. Kochava will track from download to registration and then report on the revenue that has been generated from that download via a player ID. (EU-US Privacy Shield and https://www.kochava.com/ )
• Tealium - The information collected by Tealium is used within our analytics tools to enrich the data we’re collecting about your visit in order to help us understand our visitors’ usage of the site so as to provide a better user experience.
• Google AdWords - Google AdWords' system is based on cookies and keywords determined by advertisers. Google uses these characteristics to place National Lottery advertising on pages where they think it might be relevant. PLI pays when users divert their browsing to click on the National Lottery advertising.
• Bing - which is a web search engine owned and operated by Microsoft. Similar to Google AdWords Bing system is based on cookies and keywords determined by advertisers.
• In case of a complaint, the information may be shared with organisations who provide services to the company such as legal advisors.
• Office of the Regulator of the National Lottery – the Regulator may access parts of this data in order to assess whether PLI is meeting its obligations to prevent underage or problem play.

Ongoing Player Interaction

Personal data processed

Gender, name, preferred greeting, address, email address, date of birth, proof of ID, IP address, date and time of visit, credit or debit card, browser, mother’s maiden name, place of birth, emailing preferences, URLs visited, referral URLs, games played, number played, amounts played, amounts added, amounts withdrawn, wallet amount, page, length of visit, cookies

Purpose for processing and uses of the data

To play any National Lottery game responsibly.

Lawful basis for processing the data

The processing of data is necessary to enter into a contract with PLI and to meet the legal and regulatory requirements of the National Lottery Act and the Licence to Operate the National Lottery. If the player does not provide the requested data, PLI will not be able to allow the player to play any National Lottery game online.

Direct marketing activity is subject to player consent. The player has the clear option to opt-in to receive marketing communications at registration time and then to opt-out any time.

Sharing of personal data

Personal Data is shared with the same organisations as outlined in the Player Registration section above.

The marketing activities outlined in the section above are carried out on an ongoing basis with player consent.

Android and iOS Apps

Personal data processed

Geo-location, name, IP address, phone device ID, device IMEI, platform, purchase total, device OS version

Purpose for processing and uses of the data

Location is required to comply with legal requirements (living in and playing from Ireland).

Lawful basis for processing the data

The processing of data is necessary to enter into a contract with PLI and to meet the legal and regulatory requirements of the National Lottery Act and the Licence to Operate the National Lottery.

If the player does not provide the requested data, PLI will not be able to allow the player to play any National Lottery game online.

Sharing of personal data

Personal Data is shared with the same organisations as outlined in the Player Registration section above.

The marketing activities outlined above are carried out on an ongoing basis with player consent.

Customer Support

Personal data processed

Name, email, twitter account, Facebook Messenger account, Instagram account, phone recordings, instant messages

Purpose for processing and uses of the data

To provide assistance to players and to monitor quality of services.

Lawful basis for processing the data

The processing of data is necessary to enter into a contract with PLI and to meet the legal and regulatory requirements of the National Lottery Act and the Licence to Operate the National Lottery.

If the player does not provide the requested data, PLI will not be able to provide player support.

Sharing of personal data

PLI shares personal data with:

• Camelot Global Services (CGS): management of PLI digital channels, customer care, IT.
• Comapi who provides our web chat facility. Comapi stores data in locations in North and West Europe.
• PLI use Conversocial to centrally manage the social media interaction with players. Conversocial stores data outside the EEA, in the USA. (EU-US Privacy Shield). Conversocial is a provider of social customer service software which is used to manage the flow of customer service inquiries and discussions on the National Lottery’s social media channels such as Facebook, twitter, Instagram and YouTube.

Winners

Personal data processed

Claim forms including: name, address date of birth, telephone number, proof of ID, signature, gender, occupation, and consent for publicity (photographs) which is gathered on a voluntary basis.

Purpose for processing and uses of the data

To comply with legal and regulatory requirements (over 18 and responsible player).

For winners above €500, or wallets exceeding €750, payment is made by cheque.

Lawful basis for processing the data

The processing of data is necessary to enter into a contract with PLI and to meet the legal and regulatory requirements of the National Lottery Act and the Licence to Operate the National Lottery. If the player does not provide the requested data, PLI will not be able to pay the player.

Publicity material is processed on the basis of consent. Once the information has been passed to the press, PLI would not be able to fulfil requests to withdraw consent.

Gender and occupation information and photograph usage permission are gathered on a voluntary basis.

Sharing of personal data

Personal data used to write the cheques is not shared with third parties.

Gender and occupation are extracted from the form and anonymised in a statistics database. The form is kept in secure storage for a duration specified in the Data Retention Policy.

If the player, or syndicate, consents to publicity, the name, winnings and photograph may be published on the National Lottery website, via email and social channels and shared with the press. It will also be archived for future “throwback” marketing purposes.

Second Chance Database

Personal data processed

Name, address, date of birth, telephone number, IP address

Purpose for processing and uses of the data

To register a retail or online National Lottery Player’s entry into a second chance draw in compliance with legal requirements (over 18 and responsible player).

To send information about offers and promotion.

The information is used internally by the National Lottery's digital marketing team.

Lawful basis for processing the data

The processing of data is necessary to enter into a contract with PLI and to meet the legal and regulatory requirements of the National Lottery Act and the Licence to Operate the National Lottery. If the player does not provide the requested data, PLI will not be able to complete the player registration for the relevant second chance draw.

Direct marketing activity is subject to player consent. The player has the clear option to opt-in to receive marketing communications at registration time and then to opt-out any time.

Sharing of personal data

PLI share personal data with:

• Action Point, who create the website in a National Lottery controlled Microsoft Azure server located in North Europe
• Google Analytics is used to measure the traffic on the second chance website. (EU-US Privacy Shield)
• HubSpot for marketing campaigns. HubSpot store personal data outside the EEA in the USA. (EU-US Privacy Shield)

Note: The EU-US Privacy Shield imposes obligations on U.S. companies to protect Europeans’ personal data. The Privacy Shield requires the U.S. to monitor and enforce data protection measures, and to cooperate with European Data Protection Authorities.