Nationale Postcode Loterij, VriendenLoterij, People’s Postcode Lottery, Deutsche Postcode Lotterie and Svenska Postkodlotteriet (hereafter: “the lotteries” or “we”) are companies with a social purpose, combining business and ideals - raising funds for good causes by operating charity lotteries in the Netherlands, UK, Germany, Sweden and Norway. The lotteries use the same recruitment system, Jobylon. Each country has its own environment in this system to ensure that HR employees in the respective countries only have access to the data that is relevant to them.  About this notice It is important that you know how we handle personal data in the recruitment process at the lotteries. We take the protection of personal data seriously. We are committed to handling your personal data in accordance with (UK) GDPR (General Data Protection Regulation) and other security and privacy regulations at all times. This Privacy Notice sets out what personal data we collect from you, how we use and share that data, how we keep your data safe, and how long we keep it for. We will also explain how we process your data (and the legal basis for doing so) and help you to understand your personal data rights.  

If you have any questions about this notice, if you have any complaints or if you would like to exercise one of your personal data rights, please tell us. 

• For Nationale Postcode Loterij en VriendenLoterij, please contact us at [email protected]. 

• For People’s Postcode Lottery, please contact our Customer Experience Team at [email protected] or call on 0808 109 8765. 

• For Deutsche Postcode Lotterie, please contact us at [email protected]. 

• For Svenska Postkodlotteriet, please contact us at [email protected]. 

When you apply for a job When you apply for a job, we process the information that you provide during your application (e.g. CV, cover letter or answers to questions asked by the lotteries) for recruitment purposes. This includes all the details in your application form and any supporting information that you provide or is collected from third parties. For most candidates this will include the following attributes: name, contact details, work experience, qualifications, salary expectations, date available, titles, education and job title.  Please remember not to provide us more personal data than is needed to apply for the position and avoid registering personal data that is sensitive or privacy-sensitive. Examples of such information are personal identity number, ethnic background, sexual orientation, political opinion, health condition, social security number, ethnic background, sexual orientation, political views, state of health, religious beliefs or trade union membership.   How personal data is processed will depend upon whether you apply directly or by using a third party like an agency or LinkedIn. Where you apply directly the lottery that you apply for is the data controller in respect of the data you provide. Where a third party provides us with your details, the third party will process your personal data in accordance with their own privacy notice. The third party and the lotteries will be data controllers in relation to your data and the third party will process your personal data in accordance with their own privacy notice.   We also collect data from third parties, such as LinkedIn and other public sources. This is called "Sourcing" and is carried out manually by our employees. Only data that can be linked to you as a professional that’s relevant to the recruitment is collected. In some cases, existing employees can make recommendations about potential job applicants. If necessary, a lottery can check whether you have the correct permit to work and live in the country where the lottery is located. In Sweden the potential job applicant will be informed of the processing of personal data by email no later than 30 days from the date of submission of the recommendation if personal data is collected via recommendation from employees.  We use Jobylon to administer our recruitment process and your data will be stored on this system while we consider your candidacy. If you become an employee these records will be incorporated into your personnel file and held in line with our normal retention period for employment files as stated in our local employment policies.   Unsuccessful applicant’s details are held for: 

• Nationale Postcode Loterij en VriendenLoterij: four weeks unless you consent to your records being kept for a year. 

• People’s Postcode Lottery: six months. 

• Deutsche Postcode Lotterie: six months. 

• Svenska Postkodlotteriet: two years. 

As part of your interview, we may record mock calls to aid us to assess your suitability for the role.  You will be informed of any recordings at the start of the call, and we will delete any recordings no later than 7 days after your interview date.  Call Monitoring In the UK all calls coming into and outgoing from our call lines and our multimedia channels are recorded and are monitored from time to time for quality, analysis and compliance reasons.  

Your personal data is shared with our suppliers and subcontractors, in their role as data processors and sub-processors, according to our instructions, for recruitment purposes. We also share personal data with authorities, legal advisors or other actors, if required by law or by decision of the authority.  We work with the following categories of data processors; Jobylon, our recruitment system, server and hosting companies, email delivery companies, information retrieval companies, analytical service companies, reference taking companies, and other companies related to the provision of the Service. Your personal data is never sold to third parties. 

We have a legitimate interest as mentioned in the GDPR to process your personal data. We will ensure that our legitimate interests are proportional and do not compromise your personal data rights. You can object to this data processing at any time. In some circumstances we may continue to process your personal data using legitimate interests where we can demonstrate that our interests override your right to object.  Other ways we use legitimate interest to process your personal data We process your personal data as part of our normal business functions. We have a legitimate interest in doing so. Those activities include:

• The operation and testing of our information technology systems. 
• Admin functions and organisational processes 

We use cookies on our website. In this section we will explain what cookies are, what cookies we use, and how you can disable cookies (and the implications of doing so) should you wish to.  

In our recruitment process, information will be stored through cookies. Cookies are small data files that are downloaded to your computer or other devices like your mobile phone or tablet when you visit our recruitment websites. Cookies help us manage how our website operates, understand how you use our website, to optimize your experience and to help us improve our marketing activities. The length of time a cookie is stored on your device can vary depending on the purpose of the cookie. 

Essential cookies are strictly necessary to provision the service.  

 For the use of non-functional cookies we require your consent. If you wish to withdraw your consent for these cookies, you can do so using cookie banner which appears when you visit the website. 

As a general rule, personal data is not sent to countries outside the EEA (European Economic Area). If we do need to transfer some of your personal data outside of the EEA, we will only do that if we have an appropriate safeguard in place for example, where:

• A country is deemed adequate by the European Commission.
• If a country is not deemed adequate, we use standard European Commission approved contracts. In case of People’s Postcode Lottery this is combined with the ICO’s approved Addendum or the ICO’s International Data Transfer Agreement. If you want to know more about these standard contractual clauses, you can read more here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en 

You have a number of personal data rights you can exercise over your personal data. You can exercise these rights at any time by contacting us as described above.  You have the right:

• to ask us not to use your personal data for direct marketing.
• to ask us not to process your personal data where it is processed based on legitimate interests if there are no compelling reasons for that processing.
• to request from us access to personal information held about you. 
• to ask for the information we hold about you to be rectified if it is inaccurate or incomplete.
• to ask that we stop any consent-based processing of your personal data after you withdraw that consent.
• to ask, in certain circumstances, to delete the personal data we hold about you.
• to ask, in certain circumstances, for the processing of that information to be restricted; and 
• to ask, in certain circumstances, for data portability. 

If an inquiry or request as described above is sent several times in a shorter period of time and the request is clearly unfounded or unreasonable, a fee may be charged to accommodate such inquiries or requests. 

We pride ourselves on our high standards of customer service and are fully committed to protecting the personal information you trust us with. If you wish to contact us to query or complain about the way we use your personal data, we will treat the matter with the utmost seriousness. If you remain unsatisfied with our handling of your complaint, you can complain to your local data protection authority. .

• For the UK you can find out more about that right and the complaint process on the ICO website or by calling 0303 123 1113 (local rate) Monday to Friday, 9am and 5pm (excluding bank holidays). 
• You can contact the Swedish Integritetsskyddsmyndigheten by email [email protected], telephone +46 (0)8-657 61 00 or mail Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm. 
• The Dutch Autoriteit Persoonsgegevens can be contacted by calling +31 88-1805250. 
• The German Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen can be contacted via Postfach 20 04 44, 40102 Düsseldorf or by email: [email protected]. 

If your personal data is compromised In the unlikely event that the personal data we hold is breached or compromised in a significant way that would be a high risk to your rights and personal freedoms, we'll contact you without delay to let you know:

• What happened and how it happened 

• What data was affected and what that means to you

• What we are doing about it and how you can stay informed

How we keep your personal data safe At the lotteries, information security is very important to our business. We are fully committed to ensuring information security, confidentiality and integrity. Your personal data is processed in accordance with the law and in a secure manner. Procedures are in place to protect your personal data and protect your privacy. For example, we only process such personal data as are necessary for the purpose and are careful to delete personal data when they are no longer needed.  The systems used to process personal data are continuously updated so that they are secure, e.g. through anti-virus programs, firewalls and systems to detect incidents regarding personal data in various IT systems. We also require and check that our partners process personal data securely and in accordance with the law.  Other examples of the way in which we secure your personal data are given below.  The information you send us online The methods we use to ensure data is safeguarded while being sent over the internet are industry standard. When information reaches us, we store it securely and only provide access to authorised personnel or data processors.  How we restrict access to your personal data The lotteries maintain strict physical, electronic, and administrative safeguards to protect your personal data from unauthorized or inappropriate access. The data we collect is stored in secure operating environments not accessible by the public 

We have the right to make changes or additions to this privacy notice at any time. You can always find the latest version of this document on our website.