The Royal Air Force Central Fund
Privacy & Cookies
The Royal Air Force Central Fund (the Fund) is committed to protecting and respecting your privacy.
This policy (together with our Terms and Conditions for the Royal Air Force Sports Lottery (the Lottery) www.rafcf.org.uk/sports-lottery/rules sets out the basis on which any personal information we collect from you, or that you provide to us, will be processed by the Fund. Please read the following carefully to understand our practices regarding your personal information and how we will treat it.
When we refer to “we” or “us” in this policy we are referring to the Fund. For the purposes of the Data Protection Act 2018, the General Data Protection Regulation (GDPR) and any applicable replacement legislation, the data controller is the Fund, whose address is Hurricane Building, HQ Air Command, RAF High Wycombe, Bucks HP14 4UE. We are a company registered in England and Wales with company number 8555984, a charity registered in England and Wales with charity number 1152560, and a charity registered in Scotland with charity number SC044299.
In this policy we use the term personal information to mean any personal data you give us from which you can be identified. This might include your name, your home address, your personal email contact details, or your telephone number. Personal information does not include information where your identity has been removed (i.e. anonymous data). We do not collect or use any special categories of personal information (for example, information about your health, race or religion).
1. Information we may collect and use
When you register to play the Lottery via our website, we may collect the following personal information from you: name, rank, station, address, telephone number, MoD email contact details, personal email contact details, payment method and frequency of payment.
If you use one of the old paper forms, JPA E015, to register to play the Lottery, to increase or decrease the number of active Lottery tickets you have, or to cancel your Lottery tickets, we will contact you to inform you of how to register or change your Lottery details via our website. We will destroy the copy of the paper form.
When you register for the Lottery, we will assign you a unique Lottery ID number. We will also keep a record of the number of active and inactive Lottery tickets you have, your ticket numbers and your Lottery win record.
If you need to update your information you can contact us via email or telephone. If we see you in person we will ask you to fill in a paper form. The paper form will provide an opportunity for you to update the following information (where applicable): current rank, previous rank, name, current station, confirmation of whether you are an MODNet user, MOD email contact details, telephone number, personal email address, request to change Direct Debit deduction date, request to increase Lottery ticket holdings and signature.
If you are a former serving member of the RAF and you win a prize in the Lottery, we may also collect your rank upon leaving the RAF, your role upon leaving the RAF, your station upon leaving the RAF and the year you departed the RAF.
When you register to play the Lottery, your personal information will be stored on a Pathway 4 database, which is hosted by Sterling Management Centre Ltd (Sterling Lotteries). Sterling Lotteries is a data processor for us and only processes personal information in line with our instructions.
If you fill in a paper form to update your Lottery details, we will scan a copy of the form and store the information on our secure servers, and we destroy the paper copy. We will also send your updated personal information to Sterling Lotteries so that they can update their records.
Your payment details for Lottery play (debit or credit card information and/or bank account details) will be held by Sterling Lotteries.
The Fund does not access or store your payment details.
If you pay for Lottery play using a debit or credit card, your card details will be held by Secure Trading Limited (Secure Trading), who act as a payment processor on behalf of the Fund. Your card details, including your card number, expiry date and customer details (name, address including postcode, telephone number and email address), will be held by Secure Trading for a period of 10 years and will be stored encrypted on their database servers.
If you pay for Lottery play by Direct Debit, your details will be held by Access Systems (UK) Limited (AccessPay), who act as a payment processor on behalf of the Fund. Your details, including your bank account name, sort code, account number, email address, lottery ID and telephone number, will be held by AccessPay for the lifetime of your Lottery play. AccessPay will store some of your personal information (name, email address, contact phone number and company name) on third party software platforms including Salesforce (Customer Relationship Management – CRM) and Marketo (Marketing Automation Platform). Access to the Salesforce and Marketo systems from third parties is limited and only applied with explicit permission from AccessPay where platform support is required. AccessPay data storage is held by Rackspace UK (UK data centre), who provide hosting and maintenance, but AccessPay manages support of the application.
Use of personal information
We collect and use your personal information in this way:
- in order to enter into, or perform, the Lottery contract we have with you; or
- if we are satisfied that we have a legitimate interest to record and retain this information for the purposes of delivering the Lottery to you.
If you win a prize in the Lottery and you consent to your details (name, rank, winning ticket number and station) being published, your information will be published in the RAF News, Social Media and the Fund’s website.
As a Lottery player we will rely on our legitimate interests to send you email marketing communications regarding the Lottery. You can unsubscribe by clicking the ‘unsubscribe’ link in any of our emails or you can contact us at firstname.lastname@example.org or on 01494 569068 at any time to opt out, change your contact details or to update your communication preferences.
1.2 Individual Sports Grants
When you apply for an individual sports grant, we collect your name, rank, station, address, telephone number, MoD email address, personal email address, Lottery play details, physical signature (if provided) and bank details.
We will also ask you to provide the name, rank, station, telephone number, MoD email address and physical signature (if provided) for the person who is endorsing your application.
We rely on our legitimate interests to collect and use this personal information for the purposes of considering your application and to make contact with you and/or your endorser in connection with your application.
1.3 Group Sports Grants
When you apply for a group sports grant, we will collect your name, rank, station, address, telephone number, MoD email address, personal email address, Lottery play details, physical signature (if provided) and bank detail of your station’s MoD Service Funds account.
We will also ask you to provide the names, ranks, stations, MoD email addresses and Lottery play details for group application attendees and the name, rank, station, telephone number and MoD email address for the person who is endorsing your application.
We rely on our legitimate interests to collect and use this personal information for the purposes of considering your application and to make contact with you, your group application attendees and/or your endorser in connection with your application.
1.4 Enrichment Grants
When you apply for an enrichment grant, we collect your name, rank, station, telephone number, MoD email address, physical signature (if provided) and the bank details of your relevant non-public bank account.
We will also ask you to provide the name, rank, station, telephone number and MoD email address for the person who is the secondary contact for your application and the name, rank, post, MOD email address, telephone number and physical signature (if provided) of your station’s non-public funds co-ordinator as well as the name, rank, position and physical signature (if provided) of the person endorsing your application.
We rely on our legitimate interests to collect and use this personal information for the purposes of considering your application and to make contact with you and/or your secondary contact in connection with your application.
If you are given an access code to use the Fund’s property at Vine Lane, we will keep a record of your name, rank or salutation, email address, telephone number and address. CCTV is in operation at this property for security purposes.
If you are given a key fob to use the Fund’s property at Danesfield, we will keep a record of your name, address, mobile telephone number and physical signature. CCTV is in operation at this property for security purposes.
We rely on our legitimate interests to collect and use this personal information for security purposes and to make contact with you regarding the Fund’s properties, where necessary.
If you are a Lottery player we will rely on our legitimate interests to send you email marketing communications regarding the Lottery. You can unsubscribe by clicking the ‘unsubscribe’ link in any of our emails or you can contact us at email@example.com or on 01494 569068 at any time to opt out, change your contact details or to update your communication preferences.
We would also like to keep in touch with you about our charitable work, including opportunities for funding and support, and future charity developments.
Email, SMS, internet messaging and telephone
We will only send you these communications by email, SMS, internet direct messaging (for example, Facebook Messenger or WhatsApp) and/or telephone with your consent. If you consent to receive marketing from us in this way, we will add your name and email, mobile phone, Social Media and/or telephone contact details to our marketing database.
You can withdraw your consent by clicking the ‘unsubscribe’ link in any of our emails or you can contact us at firstname.lastname@example.org or on 01494 569068 at any time to opt out, change your contact details or to update your communication preferences.
We may also send marketing information to you by post from time to time if we are satisfied that we have a legitimate interest to do so. You can contact us at email@example.com or on 01494 569068 at any time to tell us that you no longer wish to receive marketing by post or to update your contact details.
1.7 Visitors to our website
When you visit our website (www.rafcf.org.uk), we may collect the following information about you:
- Information that you provide by filling in forms on our website. This includes information provided at the time of registering for the Lottery, subscribing to email alerts or requesting further services. We may also ask you for information when you enter a competition or promotion sponsored by the Fund, and when you report a problem with our site.
- If you contact us via our website, we may keep a record of that correspondence.
- We may ask you to complete surveys that we use for research purposes, although you do not have to respond to them.
- Details of your visits to our site and the resources you access.
Our website is not intended for children under the age of 16.
We may collect information about your computer, including (where available) your IP address, operating system and browser type, for system administration. This is statistical data about our user’s browsing actions and patterns, and does not identify any individual.
We will use this information if we are satisfied that we have a legitimate interest to do so:
- to ensure that content from our site is presented in the most effective manner for you and your computer;
- to allow you to participate in interactive features of our service, where these are available and you choose to do so;
- to ensure the security of your account and our business, preventing or detecting fraud or abuses of our website, for example, by requesting verification information in order to reset an account password.
We use a third party data processor, Big Fish Internet Ltd, to help maintain the security and performance of our website. To deliver this service Big Fish Internet Ltd processes the IP addresses of visitors to our website.
A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer’s hard drive. We use the following cookies:
- Strictly necessary cookies. These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website.
- Analytical/performance cookies. These allow us to recognise and count the number of visitors to our website and to see how visitors move around when they are using it. This helps us to improve the way our website works, for example by ensuring users are finding what they’re looking for easily.
- Functionality cookies. These are used to recognise you when you return to our website. This enables us, for example, to pre-populate log-in details and remember your preferences.
- Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website more relevant to your interests. We may also share this information with third parties for this purpose.
You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies.
1.8 People who contact us via social media
If you send us a private or direct message via social media, we may share this information with other members of our staff if we are satisfied that we have a legitimate interest to do so, for example, in order to respond to a specific query or to pass on information. We will not share any personal information that you provide in a message with any other organisations without your consent.
1.9 Queries and complaints
If you send a query or complaint to us, we will use the personal information you provide to us (for example, your name and the name(s) of any other individuals involved) in order to process your query or complaint and respond to you. Where we consider it necessary or appropriate, we will share this information with third parties such as the Information Commissioner’s Office, the Charity Commission or the Gambling Commission.
2. Sharing personal information
We only ever use your personal information if we are satisfied that it is lawful and fair to do so. We will never sell your personal information or share it with third parties who might use it for their own commercial purposes.
We will only disclose your personal information to third parties:
- where you have given us consent to share the information with the specific third party;
- where information is accessed by New CMI Ltd who provide technical support;
- where your information is shared with Sterling Lotteries, Secure Trading and Big Fish Internet Ltd for the purposes of delivering the Lottery;
- if we transfer your payment information to Barclays Bank UK PLC, who provide banking services to us;
- if we are under a legal duty to disclose or share your personal information, for example, if required to do so by a court order or for the purposes of prevention of fraud or other crime;
- in order to enforce any terms and conditions or agreements between us;
- to another legal entity, on a temporary or permanent basis, for the purposes of a joint venture, collaboration, financing sale, merger, reorganisation, change of legal form, dissolution or similar event. In the case or a merger or sale, your personal information will be permanently transferred to a successor company; or
- to protect our rights, property and safety, or the rights, property and safety of others (this includes exchanging information with other companies, organisations and regulators for the purposes of fraud protection and credit risk reduction).
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use and share such information without further notice to you.
We may share your personal information with the following third party organisations:
- Sterling Lotteries (http://www.sterlinglotteries.co.uk/)
- Secure Trading (https://www.securetrading.com/)
- AccessPay (https://www.accesspay.com)
- Big Fish Internet Ltd (https://www.wearebfi.co.uk/)
- New CMI Ltd (https://newcmi.com/)
- Barclays Bank UK PLC (https://www.barclays.co.uk/business-banking/)
3. Data Security
We have appropriate security measures in place to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
- We hold data electronically in our secure document management system and on our on-site file servers, which are protected by both hardware and software firewalls.
- We have off-site back-up servers in secure UK locations.
- We encrypt all data stored on our servers with an industry standard encryption method that encrypts the data between your computer and our server so that in the event of your network being insecure at any time no data is passed in a format that could easily be deciphered.
- We regularly back up and encrypt all of the data we hold.
- We store papers in lockable cabinets in our offices when not being actively used and we have a secure off-site document storage facility for archived papers.
- Our offices are secure.
- When necessary, we dispose of or delete your data securely.
- We ensure that our employees, agents and contractors are aware of their privacy and data security obligations and we take reasonable steps to ensure that employees of third parties working on our behalf are aware of their privacy and data security obligations.
- We limit access to your personal information to those employees, agents, contractors and other third parties who have a need to know.
Where we have given you (or where you have chosen) a password, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.
We will only transfer the personal information you give us to countries outside the European Economic Area (EEA) if you are based outside the EEA and the transfer is necessary in order to deliver our services to you. In these circumstances we will, as required by applicable law, ensure that your privacy rights are adequately protected by appropriate technical, organisational, contractual or other lawful means.
The transmission of information via the internet is never completely secure. Although we will do our best to protect your personal information, we cannot guarantee the security of your information transmitted to our site and any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
4. Data retention
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.
|Lottery players||Duration of play plus 3 years|
|Individual Sports Grant applicants||Duration of grant processing plus 7 years|
|Group Sports Grant applicants||Duration of grant processing plus 7 years|
|Enrichment Grant applicants||Duration of grant processing plus 7 years|
|Marketing contact details||Until you unsubscribe or opt-out|
|Cookies||2 weeks from the date of collection of the data|
These retention periods may be extended or reduced if required by applicable law or we deem it necessary, for example, to defend legal proceedings or if there is an on-going investigation relating to the information.
We review the personal information (and the categories of personal information) we hold on a regular basis to ensure the information we are holding is still required and is accurate. If we discover that certain information we are holding is no longer necessary or accurate, we will take steps to correct or delete the data.
5. Your rights
Under certain circumstances, by law you have the right to:
- Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
- Ask us to correct personal information that we hold about you which is incorrect, incomplete or inaccurate.
- Ask us to erase your personal information from our files and systems where there is no good reason for us continuing to hold it.
- Object to us using your personal information to further our legitimate interests (or those of a third party) or where we are using your personal information for direct marketing purposes.
- Ask us to restrict or suspend the use of your personal information, for example, if you want us to establish its accuracy or our reasons for using it.
- Ask us to transfer your personal information to another person or organisation.
- We do not carry out any automated decision making which has a legal effect or otherwise significantly affects you.
If you want to exercise any of these rights, please contact at firstname.lastname@example.org or on 01494 569068 in writing.
If you have given your consent to us processing your personal information, you have the right to withdraw your consent at any time. To withdraw your consent, please contact at email@example.com or on 01494 569068. Once we have received notification that you have withdrawn your consent, we will no longer process your personal information and, subject to our retention policy, we will dispose of your data securely.
7. Queries and Complaints
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.