Data protection

At Crackerjackpot, we are committed to respecting and protecting your privacy. This notice explains how we collect, use and store personal information about you.

We may change the terms of this privacy notice from time to time. Please check this part of our website to see what has changed.

If you have any questions regarding our use of your information, please email or write to Data Protection Officer, Crackerjackpot, Hayes Road, Sully CF64 5XX

Who we are

Crackerjackpot Ltd is a wholly owned trading subsidiary of Tŷ Hafan and operates the Tŷ Hafan lottery. It is a company limited by guarantee, registered in Wales (No: 08221671) and licensed with the Gambling Commission.

Tŷ Hafan, the hospice for children in Wales is a registered charity (No: 1047912) and charitable company limited by guarantee (No: 307406), registered in Wales.

Tŷ Hafan Trading Ltd is a wholly owned trading subsidiary of Tŷ Hafan and manages Tŷ Hafan’s retail operation including shops, warehouse and online trading outlets. It is a company limited by guarantee, registered in Wales (No: 05129825).

The registered address of all three entities is Hayes Road, Sully CF64 5XX

Tŷ Hafan has a separate privacy notice that explains how the charity will hold and use your personal information. It can be read here.

How we collect information about you

We collect your personal information when you:

–  Become a member of our lottery
–  Buy a lottery ticket in a Tŷ Hafan shop
–  Pay for a specified number of plays via our website
–  Make a donation to Tŷ Hafan via your lottery membership
–  Contact us via email, phone, SMS, social media, post or our websites
–  Apply to work or volunteer for us

We may also collect information about your visit to our websites. This data is not personal to you and is used to help us better understand how visitors use our site, analyse the website performance and develop the website effectively.

What personal information we collect

We collect personal information such as name, address, email, phone number and bank account details. We do not record debit card details.

Our legal basis for processing your information

We process your information to fulfil the contract we have with you (i.e. to enter you into the lottery draw), when it is our legal duty (e.g. to comply with our responsibilities under the Gambling Act 2005) and also where you have given us your consent or where we are confident it is in our legitimate interests to do so.

How we use your personal information

We use your personal details for the purposes of administering your lottery membership, participation in the weekly draw and notification of winning. The rollover and jackpot winners are usually notified by telephone.

Your personal information may be used to process a donation, for analysis purposes or for regulatory and Gambling Commission compliance reasons.

We may also use your details to keep you updated about how your support is helping Tŷ Hafan, to inform you of forthcoming events and to contact you for fundraising purposes. This could be by email (if you have given us your consent) or by post (if we believe we have a legitimate reason to do so and you have not already told us you do not want to be contacted by post).

If you no longer wish to receive these types of communications or want to change your contact preferences, please follow the unsubscribe link on a relevant email or contact us directly: call 029 2053 2300, email or write to us at Crackerjackpot, Hayes Road, Sully CF64 5XX.

Sharing your information

We never sell or share any information about you to other organisations for their own marketing purposes.

Your details may need to be shared with third party organisations who are working on our behalf. These organisations act as data processors and in these instances, we ensure a contractual agreement is in place to protect your data and ensure it is only retained for the necessary duration.

Your personal information may also be shared with third party organisations to comply with legal or regulatory obligations.

How we protect your information

We take all reasonable care and precautions to protect your information and use a combination of both physical and technical measures.

Online financial transactions are processed using SagePay which has the highest level of Payment Card Industry Data Security Standards (PCI DSS) compliance and any personal information you provide is encrypted.

While we take appropriate steps to protect your information online, we also protect your information offline.  We do not retain debit card details and our staff receive data protection training to ensure any personal data is handled and processed appropriately. Our computer network is guarded by firewalls and kept in a secure environment on servers located within the European Union.

Some of our premises have CCTV installed. This is for security reasons and the footage is only held for a maximum of 30 days unless we are required to disclose the images for legal reasons.

Unfortunately, the internet is not completely secure and although we will do our best to protect your information, we cannot guarantee its complete safety and any information provided is at your own risk.

Cookies and Third Party websites

Our website uses essential cookies to ensure you receive the best browsing experience possible.  It’s important to us that you are aware of how these cookies are used, and we’d like to reassure you that no personally identifiable information is ever collected.

If you would prefer to disable cookies, please visit for information on how to change your preferred browser settings.  For more information on Google Analytics cookies please visit their website.

We may link you to third party websites which have their own privacy policies. We encourage you to look at their policies as we cannot accept any responsibility or liability for the content or security of those websites.

Your rights

You are in control of how we use your data.

If you think any of the information we hold on you is incomplete or inaccurate, you have the right to have this rectified. Please contact us and we will check its accuracy and correct it.

You have the right to request a copy of your personal information held by us (known as a Subject Access Request).

If you feel we should no longer be using your personal information, you can request that we stop using or erase the information we hold on you. We will confirm that the information has been restricted, anonymised or removed. However, we may not be able to comply with your request if we are required to retain your information for legal or audit purposes. If these circumstances apply, this will be fully explained to you.

To exercise any of your rights under data protection law, please contact Data Protection Officer, Tŷ Hafan, Hayes Road, Sully CF64 5XX or email

How to make a complaint

If you would like to make a complaint about the processing of your data, please contact us at the address above. If you are not satisfied with our response, you can complain to the Information Commissioners Office (ICO) by calling their helpline on 0303 123 1113 or via their website