Everton Lotteries Privacy Policy


1        Introduction

2        About Us

3        Management Responsibility

4        Information we collect and what we do with it

5        Fair and Lawful Processing

6        Personal Information and the Internet

7        Data Accuracy and Updates

8        Data Enrichment

9        Electronic Marketing

10           Data Retention

11           Information Rights

12           Access to Data

13           Cookies

14           Sub-Processors

15           Information Disclosures

16           Information Sharing

17           Transfers of Information outside Europe

18           Information Security Arrangements

19           Data Processing Equipment and Media

20           Destroying Data, Media, and Equipment

21           Incidents

22           Training and Awareness

23           Information Risk Management

24           Audit and Management Reporting

25           Changes to the Privacy Policy

26           How to Contact Us

1        Introduction

1.1       Everton Lotteries [also Everton FC Development Associate] (‘we’, ‘us’ or ‘our) is a society lottery registered with the Gambling Commission with reference number 30315] whose office is at Goodison Park, Goodison Road, Liverpool L4 4EL. The term ‘you’ refers to the user or viewer of this Privacy Policy.

1.2       This Privacy Policy explains what information we (Everton Lotteries) collect, how we may use it, and the steps we take to ensure that it is kept secure. It also explains the rights an individual has in respect of their personal information and how to contact us.

1.3       This Privacy Policy is part of a formally documented information governance system and is subject to periodic review.

1.4       We can be contacted using the contact details at section 26.

2        About Us

2.1       We operate Everton Lotteries and fundraising activities for and on behalf of Everton Football Club and Everton in the Community in the form of lotteries and games of chance.

2.2       We recognise our responsibilities as a provider of services which process personal information and we take great care to protect the personal information that we process. We operate and maintain a comprehensive information governance management system comprising several policies and procedures, a record keeping system, document management system, internal audits and periodic external audits.

2.3       We are registered as a data controller in the United Kingdom and our registration number is Z1667225.  Refer to the Information Commissioner’s Office (ICO) website www.ico.gov.uk  ‘Register of Data Controllers’ for further information.

3        Management Responsibility

3.1       The Lottery Manager has overall responsibility for our privacy and data protection compliance.  The Head of ICT is responsible for the application of our privacy and data protection arrangements.  The Club’s Governance Committee is chaired by the Finance Director and is responsible for monitoring the privacy and data protection (‘PDP’) record keeping system; ensuring our day-to-day work practices conform to the high standards we expect; and for reporting through the Head of ICT to the Chief Executive Officer the standards maintained regarding our information governance.

4        Information we collect and what we do with it

4.1       We collect personal information from a range of sources in order to run our business activities.  We maintain a register of data collection activities and perform periodic reviews of our data collection activities and processes in order to test that they conform to our expectations.  We aim to only collect information that is necessary for us to perform our business operations efficiently and effectively.  We periodically review our data collection arrangements.

4.2       We aim to provide anyone whose information we are collecting with sufficient information so that they know who is collecting their information and what we intend to do with it.  If this information is not obvious from the data capture mechanism, we may choose to provide this information in the form of a Privacy Statement or Fair Processing Notice on or linked to a data capture form. 

4.3       Below are listed some of the data sources we use, the nature of the data we collect and the reasons why we collect and process it.

4.4       Customer Data.  In order to provide the services that we are engaged to provide by our customers (such as selling lottery membership, prize draws and scratch cards) we collect, store and use personal information disclosed to us online on our website, in person at our shops and premises, on the phone through telephone conversations, and through our network of agents and collectors.  The data that we collect for these purposes includes names and addresses, dates of birth, contact information (such as phone numbers and email addresses), and financial information (such as credit/debit card information).  We use this information to process purchases and to undertake marketing activities such as building a profile of our customers. We also share most of this data with other members of the wider Everton Football Club group, including the Everton Football Club Company Limited and Everton in the Community so that they can build a profile of their customers.  We also collect and process information about our sales prospects and suppliers.  Information of this nature is recorded and stored in specialist database systems.

4.5       Financial Information.  We use your financial information to process payments for products and services that are purchased from us and for fraud detection and prevention.  We maintain an appropriate accreditation under the PCIDSS (Payment Card Industry Data Security Standard) in order to apply high standards of information governance for financial information that we process.

4.6       Employee & Agents Data.  As an employer we collect and process information about applicants for jobs and details about people that we employ.

Other Data Collection

4.7       We use ‘cookies’ on our web sites that allow us to recognise returning system users, and customise their experience.  Cookies can collect and use data. Please see section 9 below for full details of the type of cookies we use, why and how we obtain your consent to use them.

4.8       We operate a policy of call recording of both inbound and outbound calls to allow us to monitor and review calls for training purposes and for the purpose of handling customer complaints.

4.9       We are employed by some third parties to provide an own branded lottery product/service and in doing so operate in the capacity of a data processor.  Personal data collected and processed where we are operating as a data processor is stored separately from personal information collected and processed in relation to Everton branded services.

4.10    We use the entire collected data set to analyse customer behaviour to help us to improve our products and services, to build a profile for each customer, and to predict customer interest.

5        Fair and Lawful Processing

5.1       Our policy is to process personal information in a fair, transparent and lawful manner.

5.2       In general, we aim to only process personal information with the consent of the data subject.  In most cases people will complete a data collection form and submit it to us.  We aim to provide sufficient information regarding how we will use the data at the point data is collected to allow the person who is completing the form to make an informed choice whether or not to give us their personal information. 

5.3       In exceptional circumstances we may process personal information without the consent of the data subject and will rely on the exemptions set out in the Data Protection Act 1998 (‘the Act’) that allow for this or on our legitimate interests to process personal information as a business.  In the latter case we would always seek to consider our interests with the rights of individuals in order to make a balanced judgement whether to process personal information without the consent of a data subject.

6        Personal Information and the Internet

6.1       Everton Lotteries maintain a web micro site within the web site structure of Everton Football Club.  Our website is used for data collection as well as providing information about the Club lottery.  We use our website to publish a list of prize winners and aim to publish the minimum amount of personal information in our list of prize winners.  We occasionally post photographs of individuals on our website.

7        Data Accuracy and Updates

7.1       It is our policy to expect those who provide us with their personal information to keep us informed of any changes to the information that we may hold about them.  If data subjects bring inaccuracies to our attention we will apply corrections to the data that we hold about them.

8        Data Enrichment

8.1       On occasions we attempt to enrich the data that we have collected through our own activities with information from other sources to help us to more accurately profile our customers and prospects.


9        Electronic Marketing

9.1       We maintain a computer-based preference centre system to manage the contact preferences of our customers in order to satisfy our obligations under the Privacy and Electronic Communications Regulations 2011.  We operate several customer touch points and the preference centre is designed to maintain a set of master preferences for email, telephone, mail, and fax marketing.

9.2       Where you have given your consent, we will use the information you provide to send you information and offers about us, from the wider Everton football group, their commercial partners and group companies.

9.3       Each data collection activity will normally contain a mechanism for customers to opt out of the Club contacting them with club marketing information.  Customers may change their preferences by contacting us at via the contact details at section 27 below.

10     Data Retention

10.1    We maintain a Data Retention Policy in which our retention periods are defined – in general we retain personal information for as long as is necessary to fulfil the purposes for which it was collected and/or in order to comply with our legal obligations.  Once personal information passes its retention deadline it is deleted and destroyed in accordance with our Data Destruction Policy.

11     Information Rights

11.1    We are aware of the rights of individuals as set out in the Act and in general of the right to fair processing of their information and we aim to uphold those rights in the processing that we undertake and in our approach to information governance. 

11.2    You have the right to:

•   see a copy of the information that we hold about you;

•   ask that the information we hold about you is corrected;

•   ask that we stop sending you marketing information; and

•   request that we remove your personal information from our database.

11.3    We apply a policy of levying a fee for any request from you to see a copy of the information that we hold about you (known as a subject access request), this is currently £10.00.  For further information about our information governance regime or to exercise any of your information rights please write to us as set out at the address below.

12     Access to Data

12.1    We control access to data on a need-to-know basis to ensure that our employees and agents only have access to the information that they need to perform their job/function.  Employees are required to sign an Acceptable Use Policy before they are allowed to use the Club’s IT assets and process the Club’s data.


13     Cookies

13.1    In common with many other website operators, we may use standard technology called 'cookies' on the Club websites. Cookies are small pieces of information that are stored by the browser on a computer's hard drive and they are used to record how people use and navigate websites.

13.2    Cookies do not attach to your system or damage your files.  Our cookies are used to enable us to develop our website to reflect your interests and by noting which pages and advertisements you have visited, how frequently particular pages are visited and determining the most popular areas of our website. We may use cookies to enrich your experience of using the Club websites by allowing us to tailor what you see to what we have learned about your preferences during your visits to the Club websites.

13.3    We use the following categories of cookies on the Club websites:

·       Category 1: Strictly Necessary Cookies

These cookies are essential in order to enable you to move around the Club websites and use its features. Without these cookies, services you have asked for such as remembering your login details or shopping basket items cannot be provided.

·       Category 2: Performance Cookies

These cookies collect anonymous information on how people use the Club websites. For example, we use Google Analytics cookies to help us understand how customers arrive at the Club websites, browse or use the Club websites and highlight areas where we can improve areas such as navigation, shopping experience and marketing campaigns. The data stored by these cookies never shows personal details from which your individual identity can be established.

  • Category 3: Functionality Cookies
  • Category 4: Targeting or Advertising Cookies
  • Category 5: Social Media Cookies

These cookies remember choices you make such as the country you visit the Club websites from, language and search parameters such as size, colour or product line. These can then be used to provide you with an experience more appropriate to your selections and to make the visits more tailored and pleasant. The information these cookies collect may be anonymised and they cannot track your browsing activity on other websites.

These cookies collect information about your browsing habits in order to make advertising more relevant to you and your interests. They are also used to limit the number of times you see an advert as well as help measure the effectiveness of an advertising campaign.  The cookies are usually placed by third party advertising networks.  They remember the websites you visit and that information is shared with other parties such as advertisers. For example, we use third party companies such as addthis.com, LiveRail and adtech to provide you with more personalised adverts when visiting other websites.

These cookies allow you to share what you’ve been doing on the Club websites on social media such as Facebook and Twitter. These cookies are not within our control.  Please refer to the privacy policy for the relevant social media platform(s) for how their cookies work.

13.4    Most browsers automatically accept cookies, but you can usually change your browser to prevent cookies being stored. Please note, if you do turn cookies off this will limit the service that we are able to provide to you and may affect your visitor experience.

13.5    For further information on cookies and how to switch them off see: www.allaboutcookies.org.

14     Sub-Processors

14.1    Where we use third parties to process personal information we do so only within the framework of a written agreement setting out the responsibilities and obligations of each party.  We undertake appropriate due diligence prior to appointing any sub processors which may involve us inspecting their data processing site and arrangements.  We require all of our sub processors to maintain a high level of governance in respect of any data that we are responsible for.


15     Information Disclosures

15.1    We are sometimes asked to disclose personal information as a one-off exercise and we maintain a policy on information disclosures.  In the case of a data subject requesting information about themselves we may treat this as a subject access request and we will follow our subject access request procedure. 

15.2    Where we are requested to disclose personal information by third parties (e.g. a public authority) we will follow our Third Party Disclosures Policy.

15.3    It is our policy to log all information disclosure requests that we receive.

16     Information Sharing

16.1    We routinely share some of the information that we collect with third parties and maintain an information sharing policy. A privacy risk assessment process is maintained to enable us to objectively consider any information sharing requests.  Information sharing is only carried out under the scope of an information sharing agreement binding on all relevant parties. 

16.2    In general, most of the personal information that we collect is shared amongst other members of the wider Everton Football Club group, including Everton Football Club Company Limited and Everton in the Community to allow them to enrich the information that they collect about fans and customers. 

16.3    Some information that we collect is shared with external third parties such as Lottery sponsors and commercial partners for them to present relevant offers to our data subjects.

16.4    Some third parties share data that they collect with us.  Unless we are bound by the terms of a data sharing agreement with any such third party this Privacy Policy and our information governance arrangements to data shall apply.  We do not share the personal information we are processing as a data processor for a third party with anyone other than that third party.

17     Transfers of Information outside Europe

17.1    As a matter of policy we aim to not to transfer any personal information that we are processing outside of the European Union unless (i) it is to a territory approved by the European Commission, (ii) it is to an organisation in the United States of America which is Safe Harbor accredited, or (iii) we have satisfied ourselves that the person with whom we are sharing information is able to uphold privacy and data protection principles to at least the same standard as the United Kingdom.  We have a process for assessing the risk posed to the privacy of our data subjects of any overseas processing.  The physical location of our data assets is recorded in our Data Asset register.

18     Information Security Arrangements

18.1    We maintain an Information Security Policy (the ‘InfoSec Policy’) which sets out the measures that we use to protect personal data that we are processing and the privacy of our data subjects.  The InfoSec Policy sets out technical measures that are deployed to identify, classify and protect data and assets, access controls used to restrict access to information, testing arrangements, incident logging and management reporting. 

19     Data Processing Equipment and Media

19.1    We maintain an asset log of all of our IT equipment including network devices, servers, and PCs, and we also maintain an asset log of our data assets (e.g. key individual databases).  We only use equipment of an appropriate specification and quality.  We maintain appropriate technical measures to protect data that we process both in respect of storage and transit as set out in our Information Security Policy.

20     Destroying Data, Media, and Equipment

20.1    Once data is no longer required we ensure that it is securely and permanently deleted.  We maintain a Data Destruction Policy which specifies the method(s) that we use to destroy data.

20.2    When storage media becomes retired it is securely destroyed.  Our Data Destruction Policy sets out the method(s) that we may use to clean and destroy storage media.

20.3    When computers and other data processing equipment is no longer required we ensure that it is appropriately disposed of in accordance with our IT and Data Asset Management Policy and Procedures.

21     Incidents

21.1    We maintain a policy of logging and investigating all information security incidents and near misses.  Our Information Incident Policy and Procedure sets out the scope of what we log, how we investigate issues, and the circumstances under which we might report or notify any third parties about such issues.  Our aim is to learn from these issues in order to enable us to continually improve our information handling.

22     Training and Awareness

22.1    We undertake regular staff training about data protection and privacy. All new employees receive data protection training as part of their induction and all other staff are required to attend periodic refresher training.  We maintain records of all training that we undertake.  We also undertake regular data protection and privacy awareness activities to keep the matter front of mind for all of our staff.

23     Information Risk Management

23.1    We have a policy of applying a risk assessment process to any major decisions we are considering that affect the data we are processing (e.g. changing supplier or major platform functionality).  We maintain a log of privacy impact assessments.

24     Audit and Management Reporting

24.1    Our Information Audit and Management Reporting Policy sets out the scope of the internal and external audits that we undertake to monitor compliance with the Act, and conformance with our own work practices to our policies. We undertake periodic internal audits and an annual external audit using a specialist data protection consulting firm.  All audit reports are logged and maintained in a register – audit actions are logged, actioned, and verified as complete.  The Head of ICT is responsible for the application of our privacy and data protection arrangements.

25     Changes to the Privacy Policy

25.1    We aim to meet high standards and our policies and procedures are therefore constantly under review. From time-to-time we may change our security and privacy policies. We maintain version control over all of our information policies and procedures to enable anyone who is interested in privacy policy and information governance arrangements to note changes. 

25.2    This Privacy Policy is periodically reviewed and was last updated on 7 March 2016.

26     How to Contact Us

Please contact us using the details below if you wish to discuss any aspect of this Privacy Policy:

Lottery Manager

Everton Football Club

Goodison Park

Goodison Road

Liverpool L4 4EL


Tel: 0151 530 5218


Email: lotteries@evertonfc.com.