Privacy policy

1. Who we are

The data controller is Garforth Brass, a registered charity in England and Wales (charity number 1116537), 11 Pinfold Lane, Leeds LS15 7SX. Data-protection matters are handled by the band’s Data Protection Officer, a committee member, who can be reached at support@garforthbrassband.co.uk. We are not required to appoint a statutory DPO but use the title for the officer who looks after this policy.

2. What we collect

• Supporters and donors — name, email address, postal address and postcode (needed for Gift Aid), donation amount and frequency, and your Gift Aid declaration.
• Lottery entrants — name, email address, the numbers you chose or were allocated, your subscription choice, your confirmation that you are 18 or over, and — before a prize is paid — copies of the identity and age documents you provide.
• Payment and subscription data — handled by our payment provider (the band uses Stripe for both donations and lottery entries). We never see or store full card numbers; we receive a transaction reference, amount and status.
• Contact form and email — whatever you send us, including complaints.
• Marketing preferences — whether you have asked for the newsletter, and any request to stop marketing or to self-exclude.
• Website data — server logs and, where you consent, analytics cookies. See section 9.

3. How we use it

• running the lottery draw, entering your numbers and paying prizes;
• verifying age and identity before a prize is paid, and refusing entries from under-18s;
• taking donations, issuing receipts and claiming Gift Aid from HMRC;
• answering enquiries and handling complaints;
• meeting our obligations as a registered charity and as a registered small society lottery — accounts, lottery returns to the licensing authority and the records the Gambling Act requires;
• safer-gambling protections, including maintaining self-exclusion and take-a-break records so that they can be enforced;
• sending you news about the band where you have asked for it.

4. Legal bases

Contract — processing your lottery entry or donation as you asked. Legal obligation — age verification, lottery records, Gift Aid and accounting records, responding to regulators. Legitimate interests — keeping the site secure, preventing fraud, improving the service and enforcing self-exclusion (which we consider to be in your interest as well as ours). Consent — the newsletter and any non-essential cookies. A lottery entry or donation is never treated as consent to marketing; you have to opt in separately, and can withdraw at any time.

5. Who we share it with

• our payment provider, to take payments and refunds (Stripe, for donations and lottery entries);
• our email and website hosting providers, who process data on our instructions;
• HMRC, for Gift Aid claims;
• Leeds City Council as licensing authority, the Charity Commission, the Fundraising Regulator or the ICO where the law requires it;
• nobody else. We do not use an External Lottery Manager and we never sell or rent supporter data.

Every provider we use is required to keep your data secure and to use it only for our purposes.

6. How long we keep it

• Lottery entry, draw and prize records — for the period required by our lottery registration and accounting rules, currently at least three years after the draw.
• Gift Aid declarations and donation records — six years after the end of the tax year they relate to, as HMRC requires.
• Self-exclusion and take-a-break records — for the duration of the exclusion and 12 months after, so that it can be enforced.
• Identity documents provided for prize verification — deleted within 30 days of verification.
• Marketing preferences — until you unsubscribe, after which we keep a suppression record so we do not contact you again.
• Enquiries and complaints — two years after closure.

7. Winners’ details

We publish draw results and winners in a privacy-safe format only — initials and town — on the lawful basis of our legitimate interest in showing that the lottery is real and fairly run. We will only publish a fuller name, quote or photograph with the winner’s written consent, which can be withdrawn at any time. Winners are notified privately by email.

8. Your rights

Under UK GDPR you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time. Some records — a self-exclusion, a lottery entry within the retention period, a Gift Aid declaration — cannot be erased early because we are legally required to keep them; we will explain this if it applies. To exercise any right email support@garforthbrassband.co.uk; we respond within one month. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

9. Cookies, security, transfers and changes

Cookies. This site sets only the cookies it needs to work (for example to remember a form in progress) and, where you consent, an analytics cookie to count visits. You can block or delete cookies in your browser settings without losing access to any page.

Security. Data is stored in password-protected systems accessible only to the named committee officers who need it. Paper forms are destroyed once transferred to the electronic record. Payment card details are handled by our payment provider and never reach us.

International transfers. Our providers may store data outside the UK; where they do we rely on UK adequacy regulations or the International Data Transfer Agreement.

Changes. We will update this policy when our practices change — for example when the lottery payment provider is confirmed — and show the revision date at the top of the page. Questions about the Wednesday draw itself are answered in the lottery terms.