How we look after your information

1. Who we are

The data controller is Buddhist Compassion Relief Tzu-Chi Foundation Limited, a registered charity in England and Wales, charity number 1050821, registered office 23a Craven Terrace, London W2 3QH. Questions about this policy, and all data protection requests, go to our data protection lead (a designated trustee or staff role) at donation@tzuchi.uk.

2. What we collect

• Supporter and donor details — name, contact details, donation history and, where you make a Gift Aid declaration, your home address and confirmation of taxpayer status.
• Lottery entrant details — name, email address, chosen numbers or lucky-dip allocation, entry and subscription history, your confirmation that you are 18 or over, and any age or identity verification evidence collected before a prize is paid.
• Payment and subscription data — handled by our payment provider, Stripe; we do not store full card numbers on our systems.
• Contact form submissions — your name, email, subject and message.
• Marketing preferences — held separately from entry and donation records.
• Website data — server logs and, where used, cookie or analytics data.

3. How we use it

We use personal data to: run the lottery draws and verify winners’ age and identity; pay prizes; take and administer donations; claim Gift Aid from HMRC; answer enquiries and handle complaints; meet our licensing, accounting and charity-law obligations; operate safer-gambling protections, including keeping self-exclusion records so they can be enforced; and, only where you have consented, send you marketing and news. Buying a lottery ticket is never treated as marketing consent.

4. Legal bases

• Contract — processing lottery entries, subscriptions and donations you have asked us to take.
• Legal obligation — age verification, licence and accounting records, Gift Aid records for HMRC.
• Legitimate interests — improving the site and our services, preventing fraud and misuse of the lottery, and maintaining self-exclusion records so that they actually protect the people who asked for them.
• Consent — marketing emails and any non-essential cookies; you can withdraw consent at any time.

5. Who we share it with

We share personal data only where needed to run our services: our payment processor, Stripe; IT, hosting and email service providers acting under contract; HMRC for Gift Aid claims; and regulators — the licensing authority, the Charity Commission, the Fundraising Regulator or the ICO — where we are required to do so. Draws are administered in-house by the charity and no External Lottery Manager is currently appointed, so no entrant data is shared with any external draw operator. We never sell personal data.

6. How long we keep it

Supporter and donation records are kept for as long as needed to administer your support and then for the periods charity accounting rules require (typically six years). Lottery entry, draw and prize records are kept for the periods our licence or registration requires. Gift Aid declarations are kept as HMRC requires. Self-exclusion records are retained for the duration of the exclusion and afterwards for as long as needed to keep the exclusion effective — that retention is the point of the record. Contact-form messages are kept only as long as the enquiry needs.

7. Winners’ details

We publish draw results using a privacy-safe format — initials and town only (for example “M. L., Manchester”) — on the basis of our legitimate interest in demonstrating that draws are genuine. Winners are always notified directly first. Anything fuller — a name, photograph or story — is published only with the winner’s prior consent, which can be declined without affecting the prize.

8. Your rights

Under UK GDPR you can ask us for: access to your data; rectification of inaccurate data; erasure; restriction of processing; a portable copy of data you provided; objection to processing based on legitimate interests, including all direct marketing; and withdrawal of any consent, at any time, without affecting earlier processing. Contact donation@tzuchi.ukand we will respond within one month. If you are unhappy with our answer you can complain to the Information Commissioner’s Office at ico.org.uk.

9. International transfers and security

Some service providers may store data outside the UK; where they do, we rely on UK adequacy regulations or appropriate safeguards such as the international data transfer agreement. We protect personal data with encryption in transit, access controls and staff and volunteer training, and we review those measures regularly. The global Tzu Chi network does not receive UK supporter data except where a programme you support requires it and this policy or a specific notice tells you so.

10. Cookies

This site sets only strictly necessary cookies and uses privacy-friendly, cookie-less analytics; we use no advertising or cross-site tracking cookies. If non-essential cookies are ever introduced, a cookie notice and controls will be added and this section updated first.

11. Changes to this policy

We will update this page when our practices change and revise the date shown at the top. Significant changes affecting lottery entrants or regular donors will be notified by email. See also our terms & conditions and responsible gambling page.