Draw Privacy Notice

Last Updated:  1^st October 2026

This Privacy Notice explains how Wave Community Bank and the Association of British Credit Unions Limited (ABCUL), trading as All Together Money (ATM), each process personal information in connection with the PrizeSaver Scheme.

Wave Community Bank processes personal information to operate your PrizeSaver account, determine your eligibility for PrizeSaver prize draws and provide relevant information for the operation of the Scheme. ABCUL processes personal information to administer the PrizeSaver Scheme, operate the prize draws, determine winning members and carry out other Scheme-related activities described in this Privacy Notice.

Further information about how Wave Community Bank processes your personal information in connection with your account more generally is available in Wave Community Bank’s Privacy Notice here: https://wavecb.org.uk/privacy-notice-3/

Controller of personal information

Wave Community Bank and ABCUL act as independent data controllers in relation to the personal information they each process in connection with the PrizeSaver Scheme.

Wave Community Bank processes personal information in connection with your PrizeSaver account, including determining your eligibility to participate in prize draws and submitting the information required for the Scheme.

ABCUL processes relevant personal information for the purposes of administering the PrizeSaver Scheme, operating the prize draws, determining winning members and evaluating the Scheme.

ABCUL’s appointed Supplier, currently Incuto Limited, acts as a data processor on behalf of ABCUL for the technical operation of the PrizeSaver Scheme, including receiving Draw Data, validating data formats, operating the prize draw mechanism and providing Scheme-related reporting.

What personal information is processed?

Here are the types of information we collect about you in order to provide the Prize Draws, to provide marketing about the Prize Draws and to evaluate the effectiveness of the Prize Draws:

• your name and contact information, including your email address and telephone number;
• information about your PrizeSaver account. This includes information about the accounts you hold with Wave Community Bank, the transactions on your account and the balance of your account;
• information to enable us to undertake Member due diligence checks on you including: Proof of identity and proof of address
• socio-demographic information (such as income, savings levels etc) which we review on an anonymised basis; and
• any information you provide about how you were made aware of the PrizeSaver account. This information is originally collected and held by Wave Community Bank and shared with ABCUL solely for the purpose of administering the Prize Draw.

Wave Community Bank collects and holds this information in connection with your PrizeSaver account. Only information required for the relevant PrizeSaver purposes will be shared with ABCUL and its appointed processor.

For what purposes is personal information processed?

Personal information may be processed for the following purposes:

• PrizeSaver eligibility. Wave Community Bank uses relevant information to determine whether you are eligible to participate in a PrizeSaver prize draw and to determine the number of entries for which you qualify.
• Operating prize draws. ABCUL uses relevant PrizeSaver information to administer the Scheme, operate prize draws and identify winning members.
• Wave Community Bank may use your personal information to communicate with you about your PrizeSaver account, your participation in the Scheme and any prizes you may win. ABCUL may also process relevant contact information where necessary for the administration or evaluation of the Scheme.
• Enquiries and requests. Wave Community Bank and ABCUL may process personal information where necessary to respond to enquiries, requests or complaints relating to PrizeSaver.
• Evaluation of the Scheme. Wave Community Bank and ABCUL may process relevant information to evaluate the effectiveness and operation of the PrizeSaver Scheme and to support its ongoing development.
• Fraud prevention and legal compliance. Wave Community Bank and ABCUL may process relevant personal information where necessary to prevent or investigate fraud, verify eligibility, comply with applicable legal or regulatory requirements and protect the integrity of the PrizeSaver Scheme.
• Where permitted by applicable law and in accordance with your marketing preferences, Wave Community Bank and/or ABCUL may use relevant personal information for PrizeSaver-related marketing and communications.

Lawful basis for processing

Wave Community Bank and ABCUL must each have a lawful basis for the personal information they process. The lawful basis will depend on the purpose for which the information is being used and may include the following:

• Contract. Wave Community Bank processes personal information where necessary to administer your PrizeSaver account and your participation in the PrizeSaver Scheme in accordance with the applicable account terms.
• Legal obligations. Wave Community Bank processes personal information where necessary to comply with applicable legal and regulatory obligations, including customer due diligence, identity verification and anti-money laundering requirements. ABCUL may also process personal information where necessary to comply with its own applicable legal obligations.
• Legitimate interests. Wave Community Bank and ABCUL may process personal information where necessary for their legitimate interests in administering, protecting, evaluating and improving the PrizeSaver Scheme. These interests may include operating and maintaining the integrity of prize draws, investigating errors or suspected fraud, responding to enquiries and complaints, evaluating Scheme performance and supporting the ongoing development of PrizeSaver. This basis will only be relied upon where those interests are not overridden by your rights and freedoms.
• Consent. Where consent is required for a particular use of your personal information, including certain direct marketing activities, the relevant organisation will ask for your consent. You may withdraw your consent at any time using the contact details set out below. Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.
• Where Wave Community Bank or ABCUL relies on legitimate interests, the relevant organisation will consider whether the processing is necessary for those interests and whether your rights and freedoms override those interests. Appropriate safeguards will be applied where necessary.

Information sharing

Personal information may be shared where necessary for the purposes described in this Privacy Notice, including with the following organisations:

• Service providers: We may share personal information with our service providers where this is necessary for the operation of the Prize Draw. This includes ABCUL’s appointed Supplier, which processes personal information on behalf of ABCUL only for the purpose of receiving Draw Data uploads, validating file formats and operating the Prize Draw mechanism on ABCUL’s instruction. Wave Community Bank may also use service providers to support its own administration of PrizeSaver Accounts, but these providers act solely on behalf of the Credit Union and do not operate the Prize Draw.
• Business transfers: We may share personal information to the extent reasonably necessary to proceed with the consideration, negotiation, or completion of a merger, reorganization, or acquisition of our business, or a sale, liquidation, or transfer of some or all of our assets.
• As required by law: We may share personal information to law enforcement agencies, courts, regulators, government authorities or other third parties. We may share personal information with these parties where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party.

International transfers of personal information

If Wave Community Bank or ABCUL transfers personal information to an organisation located outside the United Kingdom, the relevant organisation will ensure that the transfer complies with applicable data protection law. Where required, appropriate safeguards or another permitted transfer mechanism will be used. Further information about any applicable safeguards can be obtained using the contact details below.

What rights do I have?

Subject to applicable law, you have the following rights:

• to request information about how your personal information is processed and to request a copy of the personal information;
• to request that any inaccuracies in your personal information are rectified;
• to request that your personal information is deleted;
• in certain circumstances, to request that the processing of your personal information is restricted;
• to object to the processing of your personal information; and
• to data portability, which allows your data to be copied or transferred from one IT environment to another. Requests to exercise your data protection rights should be directed to Wave Community Bank, as the primary holder of your personal information.

If you wish to do any of these things, please contact Wave Community Bank at info@wavecb.org.uk.

How long is personal information kept?

Wave Community Bank will retain personal information relating to your PrizeSaver account for as long as necessary to administer the account and for any additional period required to meet its legal, regulatory, audit, complaints-handling and record-keeping obligations. Further information about the Credit Union’s retention arrangements is available in its Privacy Policy.

Personal information processed by ABCUL in connection with PrizeSaver is stored and processed on ABCUL’s behalf by its appointed data processor, currently Incuto Limited.

Under the data retention arrangements for the PrizeSaver Scheme, Incuto retains active Scheme data for the duration of your participation in PrizeSaver. Prize Draw results will be retained for six years from the date of the relevant draw, audit logs for seven years from creation, and backups containing personal information for up to 30 days.

Draw Data that is no longer required for the purposes of operating the Scheme, audit and assurance activities or investigating suspected fraud will be securely deleted or irreversibly anonymised. Information relating to confirmed winners may be retained for up to six years where required for financial reporting, audit or fraud-prevention purposes.

Contacts, notices and revisions

If you have any questions about this Privacy Notice, please contact Wave Community Bank at info@wavecb.org.uk. We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If you are not satisfied with how your personal information has been handled, you also have the right to make a complaint to the Information Commissioner’s Office (ICO). Further information is available at www.ico.org.uk.

We may modify or update this Privacy Notice from time to time. Where changes to this Privacy Notice will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on individuals, we will give you sufficient advance notice so that you have the opportunity to exercise your rights (e.g. to object to the processing).