LUCKY 6

Player Privacy Policy

Penrith Taxation Social & Sporting Club

1. About This Policy

This policy explains what personal information Penrith Taxation Social & Sporting Club ("the Club") collects when you play Lucky SIX, why it's collected, how it's stored, and what rights you have over it. It applies to the Lucky SIX player web page and the Club's related record-keeping.

2. What We Collect

When you create a ticket, you're asked to enter the following information:

What we collect	Why we collect it	Required?
Your name	To identify who a ticket belongs to and to confirm winners	Yes
Workpoint / department	Internal club record-keeping	Yes
Email address	To send your payment confirmation and notices about your tickets or any prize, and as your player ID — it is how we match tickets to the right person and prevent mix-ups, and how you look up your own tickets	Yes
Your chosen numbers (Set 1 & Set 2)	To run the draw and check your ticket against the winning numbers	Yes
Ticket ID, week number, payment reference and payment status	To track which tickets have been paid for and confirm entries	Yes
A payment receipt (a screenshot, PDF or emailed receipt)	Only if you choose to upload one, to match your payment to your ticket quickly. The club can also check your payment by hand	No — optional

We do not collect your date of birth, address, phone number, financial account details or any government ID number through the Lucky SIX page itself. Payment is made directly through the Club's payment provider (Square) — the Lucky SIX system never sees or stores your card details.

A receipt you upload can itself show personal information — typically the card brand and last four digits of your card, your email address (in an emailed receipt) and, in a screenshot, anything else visible on your screen — so please upload only the receipt itself.

3. How Your Information Is Stored

Ticket and player information is stored in Google Firebase (Firestore), a cloud database service. Access to this data is restricted to authorised Club administrators who are logged in with a password-protected account.

Ticket, payment and receipt information is held in Google Cloud services located in Australia (Sydney). A receipt you upload is stored there in full and can be seen only by authorised Club administrators.

A small number of your preferences — such as your favourite number picks — are also saved locally in your own browser ("local storage") on the device you're using. This local data is never transmitted to the Club and stays on your device only, until you clear your browser data.

4. Who Can See Your Information

• Authorised administrators and committee members of Penrith Taxation Social & Sporting Club, for the purpose of running the draw, confirming payments, and contacting winners.
• Google Firebase, as the Club's cloud data-hosting provider, which stores the data on the Club's behalf under its own security and privacy terms.
• An automated receipt-reading (AI) service, used only if you upload an image or PDF receipt, to read the amount and payment reference and speed up payment checking. The service is run by a provider whose servers are outside Australia. It receives only the receipt file itself (not your name or ticket details, unless they appear on the receipt), and an administrator can review the result. Emailed (.eml) receipts are checked in Australia by verifying the sender's digital signature and are not sent to this service. If you would rather not use it, simply do not upload a receipt — the Club can check your payment by hand.
• Google's email service, used to send payment confirmations, notices about your tickets and prize announcements. These emails contain your name and ticket details.
• Square (or the Club's nominated payment provider), only for the payment itself — the Club matches your payment to your ticket using the reference number you provide, but does not receive your card or bank details.

We do not sell or rent your information, and we do not share it with any third party other than the service providers listed above. We do not use it for advertising or marketing purposes.

5. How Long We Keep It

Ticket records are kept for as long as reasonably needed for prize verification, dispute resolution, and the Club's financial record-keeping obligations. If you'd like your historical ticket data removed sooner, contact the Club using the details in Section 8 and we will action reasonable requests, subject to any records we're legally required to retain.

Records are not deleted automatically: they remain until the Club's administrators archive or delete them. The exact period for which ticket, payment and receipt records are kept is to be confirmed by the Club and will be published here.

6. Your Rights

You can ask the Club at any time to:

• Tell you what personal information it holds about you;
• Correct any information that is inaccurate or out of date; or
• Delete your information, where the Club is not required to keep it for legal, financial or dispute-resolution reasons.

To make a request, contact the Club using the details in Section 8. We'll respond within a reasonable time.

7. Children & Eligibility

Lucky SIX is only open to players aged 18 years or older. We do not knowingly collect information from anyone under 18.

8. Complaints & Contact

Questions, concerns or requests about how your information is handled should be directed to the Club at penrithtaxationsocialsportingclub@ato.gov.au.

If you're not satisfied with the Club's response, you can also contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9. Changes to This Policy

The Club may update this policy from time to time. The current version will always be available on the Lucky SIX player page. This policy was last updated on 21 October 2026.