Privacy Policy

FernHarbour Community Trust ("we", "us", or "our") is committed to protecting your personal information. We recognize that by purchasing a ticket in our lottery, you are placing your trust in us. This Privacy Policy outlines how we collect, use, store, and disclose your personal information in accordance with the Privacy Act 2020 (New Zealand).

1. Information We Collect

To operate a compliant Class 3 Gambling operation, we are required to collect specific information from you. We may collect the following types of personal information:

• Identity Data: First name, last name, and date of birth (required for age verification under the Gambling Act 2003).
• Contact Data: Email address, telephone number, and residential address (required for prize delivery and residency verification).
• Transaction Data: Details about payments to and from you and details of tickets you have purchased from us. Note: We do not store full credit card details. Payments are processed via secure third-party payment gateways.
• Technical Data: Internet Protocol (IP) address, browser type and version, time zone setting, and operating system (collected via cookies).
• Usage Data: Information about how you use our website and services.

2. How We Collect Your Data

We use different methods to collect data from and about you including through:

• Direct interactions: You may give us your Identity, Contact and Financial Data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you create an account, purchase tickets, or request marketing to be sent to you.
• Automated technologies: As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies (see our Cookies Policy).

3. How We Use Your Information

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• To conduct the Lottery: Processing your ticket purchase, issuing ticket numbers, and conducting the draw.
• To verify your eligibility: Ensuring you are over 18 years of age and a resident of New Zealand, as required by our DIA Class 3 Licence.
• To notify winners: Contacting you if you win a prize and arranging for delivery.
• To manage our relationship with you: Notifying you about changes to our terms or privacy policy, or asking you to leave a review.
• For auditing purposes: Providing records to our independent auditor and the Department of Internal Affairs (DIA) as required by law.

4. Disclosure of Your Information

We respect your privacy and will not sell your data to third parties. However, we may have to share your personal data with the parties set out below for the purposes set out in Section 3:

• Service Providers: Companies that provide IT and system administration services (e.g., website hosting), and payment service providers (e.g., Windcave, Stripe) to process secure transactions.
• Professional Advisers: Lawyers, bankers, auditors, and insurers who provide consultancy, banking, legal, insurance, and accounting services.
• Regulators: The Department of Internal Affairs (DIA) and the Inland Revenue Department (IRD) who require reporting of processing activities in certain circumstances.

5. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. Access to your personal data is limited to those employees, agents, contractors, and other third parties who have a business need to know.

All sensitive transaction data is transmitted via Secure Socket Layer (SSL) technology and encrypted.

6. Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Under the Gambling Act 2003 and financial reporting laws, we are required to keep basic information about our customers (including Contact, Identity, and Transaction Data) for a minimum of seven (7) years after they cease being customers.

7. Your Rights

Under the Privacy Act 2020, you have rights in relation to your personal data. You have the right to:

• Request access to your personal data (commonly known as a "data subject access request").
• Request correction of the personal data that we hold about you.
• Request erasure of your personal data (subject to our legal retention obligations outlined in Section 6).
• Object to processing of your personal data where we are relying on a legitimate interest.

If you wish to exercise any of the rights set out above, please contact our Privacy Officer.

8. Marketing Communications

You will receive marketing communications from us if you have requested information from us or purchased tickets from us and have not opted out of receiving that marketing. You can ask us to stop sending you marketing messages at any time by following the "unsubscribe" links on any marketing message sent to you.

9. Contact Details

If you have any questions about this privacy policy or our privacy practices, please contact our Privacy Officer: