Last updated 9th January 2025: Change of National Lottery address; updates to the Details of Processing Activities section.
Previous update, 13th February 2024: Periodic review & update. Changes to reflect data captured by the Retailer Applications app.
Premier Lotteries Ireland DAC (“PLI”) is the operator of the Irish National Lottery. PLI was awarded a 20-year Licence to Operate the National Lottery (“Licence”) by the Irish Government in February 2014 and commenced operations in November 2014. PLI is based in the National Lottery HQ at 1GQ, George’s Quay, Dublin 2.
This Data Privacy Statement is designed to demonstrate our firm commitment to privacy and to inform you of the Personal Data that we collect and process in connection with your Retailer activity.
“Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. This is the meaning assigned to the term in the General Data Protection Regulation (EU) 2016/679 (GDPR).
PLI is the controller of Personal Data collected and processed from Retailers.
This Data Privacy Statement sets out details of what Personal Data we process, why we process it, with whom your Personal Data is shared, and a description of your rights with respect to your Personal Data.
This Data Privacy Statement will be reviewed from time to time to take into account ongoing developments at the National Lottery and any changes in the law.
To comply with our obligations under the National Lottery Act 2013, we will collect and process information about you referred to in this Data Privacy Statement as Personal Data.
This information will include data provided via the Retailer Applications app, your Retailer registration details and use of the Retailer Portal.
The categories of Personal Data we process, and the lawful bases for doing so, are set out in the Details of Processing Activities section at the end of this Data Privacy Statement.
If you access the National Lottery website, cookies are deployed to distinguish you and your preferences from other users of the site, when you give us permission to do so. This helps us to improve your experience when you browse the website.
The Cookie Policy is available on the website at https://www.lottery.ie/useful-info/cookies and should be read in conjunction with this Data Privacy Statement as the same data protection rights apply to cookies.
The National Lottery’s general, and website specific, Data Privacy Statement may be found here: https://www.lottery.ie/useful-info/privacy
The Personal Data we hold, process and retain will be used for management and administrative purposes and for meeting our legal and regulatory obligations. We hold it and use it to protect your rights and interests and to manage our relationship with you appropriately, effectively and lawfully. At the same time, it enables us to run our business.
This includes using your Personal Data to enable us to manage our contractual relationship, comply with legal obligations, pursue our legitimate interests and protect ourselves in the event of legal proceedings.
The uses we make of each category of your Personal Data, together with the lawful bases we rely on for those uses are set out in more detail in the Details of Processing Activities section at the end of this Data Privacy Statement.
Where there is a need to process your data for a purpose other than those set out at the end of this Data Privacy Statement, or otherwise outlined to you, we will inform you of this. This Data Privacy Statement will then be updated accordingly.
PLI is certified to the ISO 27001 standard for Information Security Management Systems, and to the World Lottery Association (WLA) Security Control Standard, for the purpose of protecting the confidentiality, integrity and availability of your Personal Data.
Your Personal Data may be disclosed to third parties where we are legally obliged to do so.
It will also be disclosed during activities where we have lawful contractual agreements in place that enable us to operate the National Lottery.
Again, you will find more detailed information on how we share your Personal Data in the Details of Processing Activities section at the end of this Data Privacy Statement.
The main country storage location of your Personal Data is Ireland.
We will transfer your Personal Data to other companies within the EEA for purposes connected with the enhancement of your online experience.
Your Personal Data will be transferred outside of the EEA during the provision of certain services which are managed and provided by third parties. Appropriate lawful data protection safeguards are in place to ensure the security of your Personal Data where it is transferred outside of the EEA.
Further details are provided in the Details of Processing Activities section at the end of this Data Privacy Statement.
Any Personal Data that we collect, process and hold about you is retained only for as long as it is lawfully required.
However, under the Licence, PLI is required to keep certain records, such as financial transactions and the Personal Data associated with that, for a period of two years after the end of the Licence agreement. That is, until the end of 2036.
In some cases, you may decline to provide us with your Personal Data. However, where we require relevant Personal Data to effectively and properly manage our contractual relationship, we may not be able to continue our contract with you if you decline to provide us with that Personal Data.
You will not be subject to automated decision making or profiling.
You have the following rights under data protection law, although your ability to exercise these rights may be subject to certain conditions and where we are permitted to do so under the terms of the Licence.
https://www.lottery.ie/about/contact-us Choose option ‘File a Complaint’.
You can contact PLI’s Data Protection Officer at DPO@lottery.ie or by calling the National Lottery on (01) 836 4444.
PLI uses a secure system for handling Data Subject Rights Requests, which is provided by a specialist service provider called OneTrust. If you would like to exercise any of these rights, please contact us via our Data Subject Rights Request link which is located here: https://www.lottery.ie/about/contact-us
Details of Processing Activities
On Application: Applicant’s name, surname, date of birth, email address, company and personal addresses; positions held; company and/or mobile telephone numbers of owners, partners, directors, officers, or principal shareholders, signature, electronic signature, directors’ names, turnover, landlord’s name, CRO number.
On Approval & Contract: Retailer’s name(s), company name, digital signature, Tax Reference number or PPS number (sole trader only).
To start the application process and to complete the contract process.
The information is used internally by PLI Sales & Operations department in accordance with PLI policies. The processing is necessary to enter into a contract with the Retailer and for our legitimate interests in managing an effective process. If the Retailer does not provide the requested data, PLI may be unable to consider the application.
In the case of a complaint, your Personal Data may be shared with organisations who provide services to the company such as legal advisors.
Regulator of the National Lottery (RNL): the Regulator may access parts of this data in order to assess whether PLI is meeting its Licence obligations. https://www.rnl.ie/
PLI stores data on servers hosted on the Microsoft Azure platform, primary located in the EEA. https://privacy.microsoft.com/en-us/privacystatement
DocuSign for the secure electronic signing of documents. https://www.docusign.com/company/privacy-policy
Retailer Portal login information, name, address, email address, mobile number, bank information, financial transactions, including sales data.
Retailer’s representatives name, email address and signatures (“Lottery Champions”).
To complete the onboarding process of the retailer, facilitating the management of financial transactions, installation of National Lottery equipment, and distribution of merchandise and relevant communication (Star Game News).
To provide a facility for Retailers to access their data through the retailer portal and complete the required Licence compliance training.
To carry out the retail reward scheme where some retailers are rewarded with One4all vouchers.
To conduct Mystery Shopper campaign as part of PLI’s Licence obligations to assess its retail network.
The processing is necessary to enter into a contract with the Retailer and for our legitimate interests in managing an effective process.
PLI has a legal obligation to ensure compliance with the standards outlined in the Licence throughout its retailer network.
PLI stores data on servers hosted on the Microsoft Azure platform primarily located in the EEA. https://privacy.microsoft.com/en-us/privacystatement
Intralot Ireland Limited (Intralot): Maintenance of PLI’s players & retailers handling platforms and retailer terminals. Intralot support engineers are based both on PLI’s premises and in Greece from where they can login using an encrypted VPN channel. All Intralot access is monitored.
ERS Computer Solutions Ltd: Maintenance of PLI’s retailer portal, using the Umbraco application, an Open-source Content Management System. The data is hosted on the Microsoft Azure platform.
https://umbraco.com/trust-center/privacy-and-umbraco/privacy-statement/
GVS Gift Voucher Shop DAC (part of Blackhawk Network group): provision of One4All gift vouchers. https://blackhawknetwork.com/privacy-policy
Store Computer Technology Ltd (SCT): Maintenance and installation of National Lottery terminals.
Open Answers: For the provision of a CTP platform which allows some retailers sell the National Lottery tickets. The CTP platform is hosted on PLI servers.
PAN Research: For conducting Mystery Shopper campaigns; only the name of the store representative will be shared with PLI.
HOPKINS MERCHANDISING LTD: For the provision of merchandising to retailer’s shops.
Sooner Than Later Solutions Ltd: For the provision of in-store posters, promotional flyers, PR signage, etc.
The Printed Image: For the provision of bespoke printed merchandise.
MediaVest Ltd: For the provision of POS merchandising.
Regulator of the National Lottery (RNL): The Regulator may access parts of this data in order to assess whether PLI is meeting its obligations to prevent underage or problem play. https://www.rnl.ie/
Name, email, phone recordings, instant messages.
To provide assistance to Retailers and to monitor quality of services.
The processing of data is necessary to enter into a contract with PLI and to meet the legal and regulatory requirements of the National Lottery Act and the Licence to Operate the National Lottery. If the Retailer does not provide the requested data, PLI will not be able to provide Retailer support.
PLI shares Personal Data with:
Intralot Ireland Limited (Intralot): For the maintenance of PLI’s players & retailers handling platforms and retailer terminals. Intralot support engineers are based both on PLI’s premises and in Greece from where they can login using an encrypted VPN channel. All Intralot access is monitored.
Zendesk for Customer Support, call management and call recording, to centrally manage inquiries, requests or any Retailer’s interactions via the support email address, and social media interactions. Please see an overview of Zendesk’s privacy here:
https://www.zendesk.com/company/privacy-and-data-protection/#gdpr-sub
Zendesk uses Twilio Inc for the storage of telephone call recordings. Zendesk Talk lawfully transfers recordings to the USA to a Twilio Inc. data centre hosted by Amazon Web Services (AWS). https://www.twilio.com/legal/privacy
Store Computer Technology Ltd (SCT): Maintenance and installation of National Lottery terminals.
PLI has closed circuit television cameras located at the entrances and exits to its offices, and in secure areas, of National Lottery HQ at 1GQ, George’s Quay, Dublin 2.
CCTV footage covering HQ entrances and exits is retained for 30 days.
Closed circuit television cameras are also installed at the National Lottery’s warehouse facilities in Ballycoolin, Dublin 15.
Video imagery of any person entering or exiting National Lottery HQ offices or secure areas, or the warehouse in Ballycoolin.
The processing s necessary to comply with PLI’s obligations under the Licence and to protect the security of staff and PLI’s property. Access to the recorded material is strictly limited to authorised personnel.
Legitimate interest: The processing is necessary for PLI to meet its obligations under the Licence to CCTV record all persons who enter and exit National Lottery premises and secure areas.
Balance of Data Subjects’ interest: Recordings of entrances and exits are only retained for 30 days and are auto-recorded over.
PLI shares Personal Data with:
Regulator of the National Lottery (RNL): The Regulator may access parts of this data to assess whether PLI is meeting its Licence obligations. https://www.rnl.ie/
Retailer ID, first name, surname, business name, mobile phone number, email address, partial address – town and county.
To conduct Good Causes awareness research and other market research surveys.
Legitimate interest: The processing is necessary for PLI to understand the impact of its work upon the community and the effectiveness of its business. For example, research into the perception of stakeholders with respect to the monies raised for Good Causes in Ireland.
Balance of Data Subjects’ interest: Retailers do not have to take part in research surveys; they may opt out if contacted and ask not to be contacted again in this regard. Survey reports provided to PLI are pseudonymised.
PLI shares Personal Data with:
RED C Research & Marketing. https://redcresearch.com/privacy-policy/
RED C retain Personal Data shared with them for a maximum of six months.
* * *
This Data Privacy Statement will be reviewed, and updated if required, on an annual basis, or sooner, if an update is required due to a change in processing activities or legal requirements.
General Data Protection Regulation (EU) 2016/679 (GDPR)
Data Protection Policy
Data Privacy Statement Web & Apps, as available on the National Lottery’s website: https://www.lottery.ie/legal/privacy