Privacy policy
Last updated: 15 October 2026
This policy explains what personal information OurLotto collects, why, and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018). It covers ourlotto.uk, syndicate sites we host (yourname.ourlotto.uk or custom domains), the OurLotto app and our billing portal.
1. Who we are
OurLotto (ourlotto.uk) is a service provided by MB Computers, a business run by Matthew Brown as a sole trader in Scotland, UK (mbc.scot). Our business address is [ADDRESS]. [COMPANY NUMBER / VAT NUMBER IF APPLICABLE]
You can contact us at [email protected]. In these pages, “we”, “us” and “our” mean MB Computers.
MB Computers is the controller of the personal information described here. Our ICO registration number is [ICO REGISTRATION NUMBER].
2. What we collect
- Enquiries: if you email us or use the “Start your syndicate” form (which opens an email to us), your name, email address, syndicate name, plan and message.
- Customers (organisers): name, email, postal address, phone (if given), the plan you’ve ordered, invoices, payment records and support messages, held in our billing portal. Card payments are handled by our payment provider [Stripe]; we never see or store your full card number.
- Syndicate members and organisers: name, email, login details (passwords are stored hashed), your role, signed syndicate agreement (name, date and time signed), contribution and payment records and payment reference, ticket numbers you or the syndicate add (including from a photo or screenshot of a ticket), votes, noticeboard posts and notification preferences.
- Syndicate bank details: the bank details the organiser enters so members can pay the syndicate.
- Push notifications: if you turn them on, your browser’s push subscription details.
- Technical data: IP address, browser type and access logs, kept for security and to prevent abuse.
We don’t collect card or bank login details, and we don’t ask for any special category data. Please don’t add any to free-text fields.
3. Why we use it and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Providing the OurLotto service: accounts, syndicate sites, ticket checking, payment tracking, agreements, reminders and notifications | Contract (with organisers and members who create an account); legitimate interests (helping organisers run their syndicate) |
| Billing, invoices and accounts | Contract; legal obligation (tax and accounting records) |
| Replying to enquiries | Legitimate interests; steps at your request before a contract |
| Security, preventing fraud and abuse, checking users are 18+ | Legitimate interests; legal obligation |
| Push notifications and optional emails such as the weekly digest | Consent (turn them off any time in your settings) |
| Service emails (password resets, payment reminders, changes to bank details) | Contract; legitimate interests |
We don’t sell your data, use it for advertising, or send marketing from third parties.
4. Syndicate organisers
Organisers can see the details of members in their syndicate (names, email, contributions and payment status) so they can run it. Organisers should only add people who know about it and should keep members’ information private. Members can see the syndicate’s tickets, results, pot, noticeboard and bank details.
5. Who we share it with
- our hosting provider (servers in [the UK]) and email providers, who process data only on our instructions;
- our payment provider [Stripe], for card payments;
- browser push services (Apple, Google, Mozilla), which deliver notifications but can’t read their content;
- professional advisers, the police or regulators, where the law requires it.
If any of these process data outside the UK, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or an adequacy decision.
6. How long we keep it
- Syndicate and account data: while the syndicate is active, then [30] days after it ends or is cancelled, then deleted.
- Member accounts removed from a syndicate: deleted within [30] days, except payment records the organiser needs for the syndicate’s accounts, kept for the life of the syndicate.
- Invoices and payment records: 6 years, for tax law.
- Enquiries that don’t lead to an order: up to 24 months.
- Server logs: up to [90] days.
7. Your rights
You have the right to: access your data; have it corrected; have it deleted; restrict or object to how we use it; get a copy to take elsewhere (portability); and withdraw consent at any time where we rely on consent. To use any of these rights, email [email protected]. We’ll reply within one month. It’s usually free.
8. Security
We use HTTPS everywhere, hashed passwords, access controls and regular backups. No system is perfectly secure; if a breach affects you we’ll tell you and the ICO where the law requires.
9. Children
OurLotto is only for people aged 18 and over. We don’t knowingly collect data about anyone under 18 and will delete it if we find we have.
10. Cookies
We only use strictly necessary cookies. See our cookie policy.
11. Complaints
If you’re unhappy with how we’ve handled your data, please contact us first. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.
12. Changes
We’ll update this policy when things change and change the date at the top. If a change is important we’ll tell account holders by email.