Privacy Policy

Details of the Privacy Policy for the Royal Air Force Central Fund.

Privacy Policy

The Royal Air Force Central Fund (the Fund) is committed to protecting and respecting your privacy.

This policy (together with our Terms and Conditions for the Royal Air Force Sports Lottery (the Lottery) www.rafcf.org.uk/sports-lottery/rules) sets out the basis on which any personal information we collect from you, or that you provide to us, will be processed by the Fund. Please read the following carefully to understand our practices regarding your personal information and how we will treat it.

When we refer to “we” or “us” in this policy we are referring to the Fund. For the purposes of UK GDPR, including the Data Protection Act 2018, the General Data Protection Regulation (GDPR) and any applicable replacement legislation, the data controller is the Fund, whose address is Hurricane Building, HQ Air Command, RAF High Wycombe, Bucks HP14 4UE. We are a company registered in England and Wales with company number 8555984, a charity registered in England and Wales with charity number 1152560, and a charity registered in Scotland with charity number SC044299.

In this policy we use the term personal information to mean any personal data you give us from which you can be identified. This might include your name, your home address, your personal email contact details, or your telephone number. Personal information does not include information where your identity has been removed (i.e. anonymous data). We do not collect or use any special categories of personal information (for example, information about your health, race or religion).

1. Information we may collect and use

1.1 Lottery

When you register to play the Lottery via our website, we may collect the following personal information from you: name, rank, station, address, telephone number, MoD email contact details, personal email contact details, payment method and frequency of payment.

When you register to play the Lottery via our Direct Debit form, we may collect the following personal information from you: serving status, title/rank, name, station/unit, address, phone number, MOD email, personal email, bank/building society account name and address, sort code code, account number, payment frequency, signature.

If you use one of the old paper forms, JPA E015, to register to play the Lottery, to increase or decrease the number of active Lottery tickets you have, or to cancel your Lottery tickets, we will contact you if we receive this to inform you of how to register or change your Lottery details via our website. We will destroy the copy of the paper form.

When you register for the Lottery, we will assign you a unique Lottery ID number. We will also keep a record of the number of active and inactive Lottery tickets you have, your ticket numbers and your Lottery win record.

If you need to update your information you can contact us via email or telephone. If we see you in person we will ask you to fill in a paper form. The paper form will provide an opportunity for you to update the following information (where applicable): current rank, previous rank, name, current station, confirmation of whether you are an MODNet user, MOD email contact details, telephone number, personal email address, request to change Direct Debit deduction date, request to increase Lottery ticket holdings and signature.

Sports Lottery players – In line with our obligations under the data protection legislation, we take every reasonable step to ensure that your personal information is accurate and up to date. If you provide personal details (e.g. rank, station, email address, phone number) on a Sports Grant or Enrichment Grant application which differs from your Sports Lottery account contact information, we will automatically update your Sports Lottery contact information.

Sterling Lotteries

When you register to play the Lottery, your personal information will be stored on a Pathway 4 database, which is hosted by Sterling Management Centre Ltd (Sterling Lotteries). Sterling Lotteries is a data processor for us and only processes personal information in line with our instructions.

If you fill in a paper form to update your Lottery details, we will scan a copy of the form and store the information on our secure servers, and we destroy the paper copy. We will also send your updated personal information to Sterling Lotteries so that they can update their records.

Your payment details for Lottery play (bank account details) will be held by Sterling Lotteries.

Payment details

The Fund does not access or store your payment details.

Following registration, your Direct Debit details will be held by Access Systems (UK) Limited (AccessPay), who act as a payment processor on behalf of the Fund. Your details, including your bank account name, sort code, account number, email address, lottery ID and telephone number, will be held by AccessPay for the lifetime of your Lottery play. AccessPay will store some of your personal information (name, email address, contact phone number and company name) on third party software platforms including Salesforce (Customer Relationship Management – CRM) and Marketo (Marketing Automation Platform). Access to the Salesforce and Marketo systems from third parties is limited and only applied with explicit permission from AccessPay where platform support is required. AccessPay data storage is held by Rackspace UK (UK data centre), who provide hosting and maintenance, but AccessPay manages support of the application.

Lottery App

The RAF Central Fund has removed the Sports Lottery App and it is no longer supported. If you had previously downloaded the App then users should be aware that it did not collect any personal information.

Use of personal information

We collect and use your personal information in this way:

in order to enter into, or perform, the Lottery contract we have with you; or
if we are satisfied that we have a legitimate interest to record and retain this information for the purposes of delivering the Lottery to you, or for historical or statistical research purposes.

A member can choose whether their name is published in draw results, if they choose to be anonymous a player can request anonymity by emailing rafsports@sterlinglotteries.co.uk. If the Member agrees, the Fund reserves the right to use the winning ticket number, the ticket holder’s name and station (if applicable) , their photograph and audio/or visual recordings of them in any related publicity. If the Member does not agree, the winner will remain anonymous in the related publicity. Members may update their preferences at any time by contacting the Lottery helpline on 0370 050 5893 or via email to rafsports@sterlinglotteries.co.uk.

As a Lottery player we will rely on our legitimate interests to send you email marketing communications regarding the Lottery. You can unsubscribe by clicking the ‘unsubscribe’ link in any of our emails or you can contact us at marketing@rafcf.org.uk or on 01494 569068 at any time to opt out, change your contact details or to update your communication preferences.

1.2 Individual Sports Grants

When you apply for an individual sports grant, we collect your name, rank, station, address, telephone number, MoD email address, personal email address, Lottery play details, physical signature (if provided) and bank details.

We will also ask you to provide the name, rank, station, telephone number, MoD email address and physical signature (if provided) for the person who is endorsing your application.

We rely on our legitimate interests to collect and use this personal information for the purposes of considering your application and to make contact with you and/or your endorser in connection with your application.

1.3 Group Sports Grants

When you apply for a group sports grant, we will collect your name, rank, station, address, telephone number, MoD email address, personal email address, Lottery play details, physical signature (if provided) and bank detail of your station’s MoD Service Funds account.

We will also ask you to provide the names, ranks, stations, MoD email addresses and Lottery play details for group application attendees and the name, rank, station, telephone number and MoD email address for the person who is endorsing your application.

We rely on our legitimate interests to collect and use this personal information for the purposes of considering your application and to make contact with you, your group application attendees and/or your endorser in connection with your application.

1.4 Enrichment Grants (E1, E2, E3 and E4)

When you apply for an enrichment grant, we collect your name, rank, station, telephone number, MoD email address, physical signature (if provided) and the bank details of your relevant non-public bank account.

We will also ask you to provide the name, rank, station, telephone number and MoD email address for the person who is the secondary contact for your application, the name, rank, and email for the person endorsing the application and, for E3 applications, the name, rank, post, MOD email address, telephone number and physical signature (if provided) of your station’s non-public funds co-ordinator as well as the name, rank, position and physical signature (if provided) of the person endorsing your application.

We rely on our legitimate interests to collect and use this personal information for the purposes of considering your application and to make contact with you and/or your secondary contact in connection with your application.

Mechanics Endowment Fund Grants (MEF)

When you apply for a MEF grant, we collect your name, rank, telephone number, MoD email address, personal email address and physical signature (if provided).

We will also ask you to provide the name, rank, station, telephone number and MoD email address for the person who is the secondary contact for your application as well as the name, rank, MOD email address, telephone number and physical signature (if provided) of your station’s non-public funds co-ordinator. The name, rank, MoD email address, telephone number and physical signature (if provided) of the person endorsing your application will also be requested.

Sports Lottery players – In line with our obligations under the data protection legislation, we take every reasonable step to ensure that your personal information is accurate and up to date. If you provide personal details (e.g. rank, station, email address, phone number) on a Sports Grant, Enrichment Grant or MEF application which differs from your Sports Lottery account contact information, we will automatically update your Sports Lottery contact information.

1.5 Fundraising

When you complete our fundraising expression of interest form, we collect your name, rank, station, telephone number, email address(es) and address.

We rely on our legitimate interests to collect and use this personal information for the purposes of considering your interest and to make contact with you to discuss fundraising opportunities.

Sports Lottery players – In line with our obligations under the data protection legislation, we take every reasonable step to ensure that your personal information is accurate and up to date. If you provide personal details (e.g. rank, station, email address, phone number) on a fundraising expression of interest form which differs from your Sports Lottery account contact information, we will automatically update your Sports Lottery contact information.

Enthuse.com

When you make a donation to the RAF Central Fund using the Enthuse platform, you may be asked to provide your name, postal address and email address. If you register to participate in an RAF Central Fund event using the Enthuse platform, you may be asked to provide your name, postal address, email address, phone number, gender, DOB and emergency medical information. We rely on our legitimate interests to collect and use this information for the purposes of entering you to participate in the event and to contact you if required. This data and any additional data you provide on the Enthuse platform will be collected and stored as per the Enthuse privacy policy: https://enthuse.com/privacy/

1.6 Donations

When you make a donation to the Fund using the Square Terminal, your data will be collected and stored per Square’s privacy policy: https://squareup.com/gb/en/legal/general/privacy

1.7 Properties

If you are given an access code to use the Fund’s property at Vine Lane, we will keep a record of your name, rank or salutation, email address, telephone number and address. CCTV is in operation at this property for security purposes.

If you are given a key fob to use the Fund’s property at Danesfield, we will keep a record of your name, address, mobile telephone number and physical signature. CCTV is in operation at this property for security purposes.

We rely on our legitimate interests to collect and use this personal information for security purposes and to make contact with you regarding the Fund’s properties, where necessary.

Feshiebridge Lodges – When you apply for a serving RAF personnel discount code for Feshiebridge Lodges your first name, surname and phone number will be issued to a third party, Sykes Cottages Ltd., who manage bookings for Feshiebridge Lodges on behalf of the RAF Central Fund. Your data will be used to temporarily hold accommodation in accordance with your booking request. This data and any additional data you provide to Sykes Cottages to complete your booking will be collected and stored as per the Sykes Group privacy policy: Sykes Cottages Privacy Policy.

1.8 Marketing

If you are a Lottery player we will rely on our legitimate interests to send you email marketing communications regarding the Lottery. You can unsubscribe by clicking the ‘unsubscribe’ link in any of our emails or you can contact us at marketing@rafcf.org.uk or on 01494 569068 at any time to opt out, change your contact details or to update your communication preferences.

We would also like to keep in touch with you about our charitable work, including opportunities for funding and support, and future charity developments.

Email, SMS, internet messaging and telephone

We will only send you general marketing communications by email, SMS, internet direct messaging (for example, Facebook Messenger or WhatsApp) and/or telephone with your consent.

You can withdraw your consent by clicking the ‘unsubscribe’ link in any of our emails or you can contact us at marketing@rafcf.org.uk or on 01494 569068 at any time to opt out, change your contact details or to update your communication preferences.

Post

We may also send marketing information to you by post from time to time if we are satisfied that we have a legitimate interest to do so. You can contact us at marketing@rafcf.org.uk or on 01494 569068 at any time to tell us that you no longer wish to receive marketing by post or to update your contact details.

Social Media

We use a Facebook pixel to track our advertising on this social media platform and as such your information may be collected through cookies and other methods. To view your Facebook ads settings and update your preferences please click here.

1.9 Visitors to our website

When you visit our website (www.rafcf.org.uk), we may collect the following information about you:

Information that you provide by filling in forms on our website. This includes information provided at the time of registering for the Lottery, subscribing to email alerts or requesting further services. We may also ask you for information when you enter a competition or promotion sponsored by the Fund, and when you report a problem with our site.
If you contact us via our website, we may keep a record of that correspondence.
We may ask you to complete surveys that we use for research purposes, although you do not have to respond to them.
Details of your visits to our site and the resources you access.

Our website is not intended for children under the age of 16.

IP Addresses

We may collect information about your computer, including (where available) your IP address, operating system and browser type, for system administration. This is statistical data about our user’s browsing actions and patterns, and does not identify any individual.

We will use this information if we are satisfied that we have a legitimate interest to do so:

to ensure that content from our site is presented in the most effective manner for you and your computer;
to allow you to participate in interactive features of our service, where these are available and you choose to do so;
to ensure the security of your account and our business, preventing or detecting fraud or abuses of our website, for example, by requesting verification information in order to reset an account password.

We use a third party data processor, Pedalo Limited, to help maintain the security and performance of our website. To deliver this service Pedalo Limited, processes the IP addresses of visitors to our website.

Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. By continuing to browse the site, you are agreeing to our use of cookies.

A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer’s hard drive. We use the following cookies:

Strictly necessary cookies. These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website.
Analytical/performance cookies. These allow us to recognise and count the number of visitors to our website and to see how visitors move around when they are using it. This helps us to improve the way our website works, for example by ensuring users are finding what they’re looking for easily.
Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website more relevant to your interests. We may also share this information with third parties for this purpose.

Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which we have no control. These cookies are likely to be analytical or performance cookies, or targeting cookies.

You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies.

1.10 Myzone

When you apply for a serving RAF personnel discount code for a Myzone Switch or belt we will collect your first name, surname, rank, MOD email and personal email. We rely on our legitimate interests to collect and use this personal information for the purposes of considering your request and to make contact with you. If you choose to use the discount code and purchase a belt through the Myzone website you will need to provide some data to complete the purchase. Please visit the Myzone privacy policy for further details: https://www.myzone.org/privacy

When you apply for a serving RAF deployed personnel discount code for a Myzone Switch or belt we will collect your first name, surname, rank, MOD email, personal email, EAW and bank account details. We rely on our legitimate interests to collect and use this personal information for the purposes of considering your request and to make contact with you. For distribution purposes your name and EAW will be shared with 83 EAG HQ, we rely on our legitimate interests to use this information for this purpose. If you choose to use the discount code and purchase a belt through the Myzone website you will need to provide some data to complete the purchase. Please visit the Myzone privacy policy for further details: https://www.myzone.org/privacy

1.11 People who contact us via social media

If you send us a private or direct message via social media, we may share this information with other members of our staff if we are satisfied that we have a legitimate interest to do so, for example, in order to respond to a specific query or to pass on information. We will not share any personal information that you provide in a message with any other organisations without your consent.

1.12 RAF Sport finance software

Merged RAF Sport Associations:

We use Yooz software to process invoices and expense requests submitted by the merged RAF Sports Associations and their members. The full name and email address of the individual submitting these requests is processed and held by Yooz in order to provide this service. Please visit the Yooz privacy policy for further details here. We recommend that individuals consider any personal data included on invoices and expenses requests before they are submitted; where the personal data is not required for the invoice or expense request to be paid, we recommend that the data is redacted.

In addition to Yooz, we use Sage Intacct accounting software. Sage Intacct processes the full name, email address and bank details as part of our invoice and expenses payment processes. Please visit the Sage Intacct privacy policy for more information.

1.13 Queries and complaints

If you send a query or complaint to us, we will use the personal information you provide to us (for example, your name and the name(s) of any other individuals involved) in order to process your query or complaint and respond to you. Where we consider it necessary or appropriate, we will share this information with third parties such as the Information Commissioner’s Office, the Charity Commission or the Gambling Commission.

2. Sharing personal information

We only ever use your personal information if we are satisfied that it is lawful and fair to do so. We will never sell your personal information or share it with third parties who might use it for their own commercial purposes.

We will only disclose your personal information to third parties:

where you have given us consent to share the information with the specific third party;
where information is accessed by BCN Group Ltd (https://BCN.co.uk) and Solutions Shared (https://solutionsshared.co.uk) who provide technical support;
where your information is shared with Sterling Lotteries (https://www.sterlinglotteries.co.uk/) and AccessPay (https://www.accesspay.com) for the purposes of delivering the Lottery;
where your information is shared with Yooz (https://www.getyooz.com/en-gb) and Sage Intacct (https://www.sage.com/en-gb/sage-business-cloud/intacct/) for the purposes of processing and paying invoices and expenses;
if we transfer your payment information to Barclays Bank UK PLC (https://www.barclays.co.uk/business-banking/), who provide banking services to us;
if we are under a legal duty to disclose or share your personal information, for example, if required to do so by a court order or for the purposes of prevention of fraud or other crime;
in order to enforce any terms and conditions or agreements between us;
to another legal entity, on a temporary or permanent basis, for the purposes of a joint venture, collaboration, financing sale, merger, reorganisation, change of legal form, dissolution or similar event. In the case or a merger or sale, your personal information will be permanently transferred to a successor company; or
to protect our rights, property and safety, or the rights, property and safety of others (this includes exchanging information with other companies, organisations and regulators for the purposes of fraud protection and credit risk reduction).

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use and share such information without further notice to you.

3. Data Security

We have appropriate security measures in place to help prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We hold data electronically in our secure document management system protected by both hardware and software firewalls.
We have off-site back-up servers in secure UK locations.
We encrypt all data stored on our servers with an industry standard encryption method that encrypts the data between your computer and our server so that in the event of your network being insecure at any time no data is passed in a format that could easily be deciphered.
We regularly back up and encrypt all of the data we hold.
We store papers in lockable cabinets in our offices when not being actively used and we have a secure off-site document storage facility for archived papers.
Our offices are secure.
When necessary, we dispose of or delete your data securely.
We ensure that our employees, agents and contractors are aware of their privacy and data security obligations and we take reasonable steps to ensure that employees of third parties working on our behalf are aware of their privacy and data security obligations.
We limit access to your personal information to those employees, agents, contractors and other third parties who have a need to know.

Where we have given you (or where you have chosen) a password, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

We will only transfer the personal information you give us to countries outside the European Economic Area (EEA) if you are based outside the EEA and the transfer is necessary in order to deliver our services to you. In these circumstances we will, as required by applicable law, ensure that your privacy rights are adequately protected by appropriate technical, organisational, contractual or other lawful means.

The transmission of information via the internet is never completely secure. Although we will do our best to protect your personal information, we cannot guarantee the security of your information transmitted to our site and any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

4. Data retention

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

Lottery players	Duration of play plus 3 years
Individual Sports Grant applicants	Duration of grant processing plus 7 years
Group Sports Grant applicants	Duration of grant processing plus 7 years
Enrichment Grant applicants	Duration of grant processing plus 7 years
Properties	Duration of property use plus 6 years
Myzone application	Duration of order processing plus 7 years
Marketing contact details	Until you unsubscribe or opt-out
Cookies	2 weeks from the date of collection of the data

These retention periods may be extended or reduced if required by applicable law or we deem it necessary, for example, for reporting, to defend legal proceedings or if there is an on-going investigation relating to the information.

We review the personal information (and the categories of personal information) we hold on a regular basis to ensure the information we are holding is still required and is accurate. If we discover that certain information we are holding is no longer necessary or accurate, we will take steps to correct or delete the data.

5. Your rights

Under certain circumstances, by law you have the right to:

Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
Ask us to correct personal information that we hold about you which is incorrect, incomplete or inaccurate.
Ask us to erase your personal information from our files and systems where there is no good reason for us continuing to hold it.
Object to us using your personal information to further our legitimate interests (or those of a third party) or where we are using your personal information for direct marketing purposes.
Ask us to restrict or suspend the use of your personal information, for example, if you want us to establish its accuracy or our reasons for using it.
Ask us to transfer your personal information to another person or organisation.
We do not carry out any automated decision making which has a legal effect or otherwise significantly affects you.

If you want to exercise any of these rights, please contact at marketing@rafcf.org.uk or on 01494 569068 in writing.

If you have given your consent to us processing your personal information, you have the right to withdraw your consent at any time. To withdraw your consent, please contact at marketing@rafcf.org.uk or on 01494 569068. Once we have received notification that you have withdrawn your consent, we will no longer process your personal information and, subject to our retention policy, we will dispose of your data securely.

6. Changes to our Privacy Policy

Any changes we make to our Privacy Policy will be posted on this page and, where appropriate, notified to you by email.

7. Queries and Complaints

If you have any questions about this privacy policy or how we handle your personal information, please contact us at marketing@rafcf.org.uk or on 01494 569068.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.