Privacy policy
This Privacy Policy (the “Policy”) explains how Golden Roo uses information and personal data that you give to us or that we collect, allowing us to manage our relationship with you effectively.
It applies to websites, apps, products, and/or services that link to this Policy or that do not have their own separate privacy notice (collectively, our services).
This Policy is intended to help you understand which data Golden Roo Casino obtain, why obtain it, how use it, the parties with whom we share it, your rights concerning its collection, use, and sharing, and other relevant privacy and security matters.
In this Policy, “Company”, “us”, and “our”, including all grammatical forms of those terms, mean the Data Controller referred to GoldenRoo Casino.
By reading this Policy, you acknowledge and understand that your Personal Data may be processed as described here. If you do not accept this Privacy Policy, do not use the Website or provide us with Personal Information.
The Company processes Personal Data under this Privacy Policy in accordance with:
1. The National Ordinance on the Protection of Personal Data (the “DPA”), together with all subsidiary legislation issued under the DPA, as amended from time to time;
2. Regulation (EU) 2016/679 of The European Parliament And of The Council of 27 April 2016 On The Protection of Natural Persons With Regard to The Processing of Personal Data And On The Free Movement of Such Data, And Repealing Directive 95/46/EC (General Data Protection Regulation) (the “Regulation” or “GDPR”).
The DPA and GDPR are collectively called the “Data Protection Laws”.
The Company decides why and how Personal Data are processed and therefore acts as the “Data Controller” under the applicable Data Protection Laws.
DEFINITIONS
Data Controller
“The Data Controller” is the natural or legal person, public authority, agency, or other body which alone or jointly with others determines the purposes and means of personal-data processing. Where Union or Member State law determines those purposes and means, that law may designate the controller or the criteria for its appointment.
The Data Processor
“The Data Processor” is a natural or legal person, public authority, agency, or other body that processes personal data on the controller’s behalf.
Personal Data
“Personal Data” means information that identifies you individually or concerns an identified or identifiable natural person, also known as a data subject.
SECURITY
The Company uses the secure internet communication protocol TLS 1.2 for protected remittances. This protocol encrypts Personal Data while it is transmitted online. We also store your Personal Data digitally on encrypted hard drives, providing an additional safeguard.
Our services are registered with site-identification authorities, enabling your browser to verify our identity before personally identifiable information is sent. Our secure servers also protect this information through advanced firewall technology.
PERSONAL DATA PROTECTION
We protect Personal Data in our possession through security systems and processes meeting the highest industry standards. Our commitment rests not only on quality and high standards, but also on the most effective application of the law. We process Personal Data only where there is a real and lawful basis under one of the grounds established by the GDPR.
PROCESSING ON THE BASIS OF OUR LEGITIMATE INTERESTS
Legitimate interests arise where we have a business or commercial reason to process Personal Data. In those circumstances, we protect all of your Personal Data and its processing, and make sure that such processing is not unfair to you or your interests.
Whenever we process Personal Data based on legitimate interests, we will tell you that we are doing so, explain those interests, and provide a way for you to raise questions and/or objections. Please note that we do not have to stop processing where the grounds for processing outweigh your right to object. For example, we may need to process data for anti money laundering purposes. The same applies where we comply with binding requirements of Curacao law, as lawful operation is one of our legitimate interests.
PROCESSING ON THE BASIS OF YOUR CONSENT
Consent is not the only basis on which we may be allowed or required to process Personal Data. We use consent only where we cannot, or choose not to, rely on another legal ground, such as a legal obligation or legitimate interests. If we process your Personal Data on the basis of consent, you may withdraw that consent at any time and in the same way you originally gave it. If you withdraw consent, we will assess whether another legal basis allows or requires further processing and notify you if that is the case. Withdrawal does not affect processing completed before you withdrew consent.
DATA RETENTION POLICY
All Personal Data retained by the Company are protected as effectively as possible and used only for purposes compatible with Data Protection Laws and other applicable laws. We retain Personal Data only for the period necessary, considering the purpose for which it was collected. What is “necessary” depends on the Personal Data involved and our particular relationship with you, including its duration.
Our usual practice is to consider whether a specific law, such as tax or corporate law, permits or requires us to retain particular Personal Data for a set period. If so, we retain it for the maximum period stated in that law. For example, data qualifying as “transactional data” must be retained for at least five (5) years.
We also consider whether laws and/or contractual provisions may be relied on against us by you or third parties and, if so, the limitation periods for those actions, which are usually five (5) years. In that case, we keep Personal Data needed to defend Ourselves against claims, challenges, or other actions by you and/or third parties for as long as necessary.
When we no longer need Personal Data, we securely delete it or anonymise it.
If you do not provide Personal Data, the Company may be unable to meet legal or regulatory duties, fulfil contractual obligations, or deliver services needed to manage and maintain your account properly. Consequently, we may be unable to offer certain products and/or services.
PERSONAL DATA WE COLLECT, THE PURPOSE & LEGAL BASIS OF SUCH DATA PROCESSING
The list below describes the Personal Data categories we process, the reasons for processing them, and the legal bases we use. The same category of data may be used for multiple purposes and under different legal grounds.
CATEGORIES OF PERSONAL DATA
1.1. Contact data: for example, your name, surname, residential mailing address and postcode, telephone/mobile number, email address, and a recent utility bill confirming your residential address.
1.2. Identity data: for example, name, surname, address, date of birth, ID card/passport number, photograph, gender, occupation, marital status and family, and hobbies.
1.3. Activity data: Website logins, activity, and transactions, including bets placed; winnings and bonuses received; Account payments and withdrawals; analytics data; parts of your browsing history; preferred bet types or games; time spent on pages; clicks; actions; cookies; phone, email, or live-chat communications with customer services; and whether you are self-excluded from our services.
1.4. Technical data: traffic data, GeoIP location, and information from the browser, computer, or mobile device you use to access our services, including device and network information.
1.5. Financial data: currency, credit-card and banking details or other payment information, and source of funds.
1.6. Data used for marketing and educational purposes: for example, name, surname, mailing address, telephone/mobile number, email address, evidence of opt-in consent where required, evidence of marketing objections, Website data, and online identifiers such as IP address and other information generated by your browser.
PURPOSE OF DATA PROCESSING
2.1. To create a record in our system, register you as a new customer, verify your identity, and prevent fraud, including third parties impersonating you through use of your data.
2.2. To add security to your credit information and credit-card use, and to provide further protection for your personal and credit data.
2.3. To offer support and protection in relation to gambling addiction problems.
2.4. To manage and monitor our ongoing relationship with you, provide sports betting and casino-game services, and deliver full customer-care services.
2.5. To subscribe you to a newsletter or campaigns and/or add you to a mailing list.
2.6. To provide information about your profile and requests; personalise your customer experience; maintain a responsible gaming environment; and retain current information about prior queries, complaints, or questions so that we can improve our services.
2.7. To monitor deposits and withdrawals and prevent unlawful use by third parties.
2.8. To send requested marketing material or marketing we are otherwise authorised to send, and to provide educational material, notifications of upcoming events, and other information that may be useful in relation to received services or educational purposes.
LEGAL BASIS FOR DATA PROCESSING
3.1. Contractual Necessity.
3.2. Legitimate Interests, including maintaining accurate system records, providing requested information, and continuously developing and offering innovative gaming and betting experiences to users.
3.3. Gambling license requirements.
3.4. Anti-money laundering and KYC regulations.
3.5. Your consent, where required or where data are processed for direct marketing.
3.6. Responsible Gaming regulations.
The Company may also obtain Personal Data from public sources, including web searches, company registers, and broadcast media, where this is reasonable and does not adversely affect your rights and freedoms.
Some data are used for checks that contribute to Profiling of your account. Profiling is any automated processing of Personal Data needed to comply with AML directives and prevent other Fraudulent activity involving your Personal Data, including Tax Evasion or suspicious betting patterns.
No automated decision is made, including for Marketing purposes. The system may automatically verify details such as an IP address or PEP checks, but human staff make the final decision in every case. Your email address is also verified, and you will receive an email to confirm that it is your own.
DATA PROCESSING ON THE BASIS OF YOUR CONSENT
For clarity, in the limited circumstances in which we cannot, or choose not to, rely on another legal ground, such as legitimate interests, we will process Personal Data based on your consent.
Where processing is based on consent, which we will never assume and will obtain from you clearly and manifestly, YOU HAVE THE RIGHT TO WITHDRAW YOUR CONSENT AT ANY TIME, in the same way that you gave it to us.
If you withdraw consent at any time by writing to us at the physical or email address below, we will decide whether another legal basis then exists, such as a legal obligation, that legally authorises or requires us to continue processing without your consent. If so, we will notify you.
You may always refuse a request for Personal Data. However, if you decline to provide data necessary for the requested services, we may be unable to provide them, especially where consent is the only available legal basis.
To avoid doubt, consent is not the only ground allowing us to process Personal Data. The preceding section sets out the various grounds on which we rely.
COOKIES
When you visit our Site, we automatically collect certain Personal Data through cookies and similar technologies. When you use the Website, a cookie is placed on your computer. Cookies and similar technologies generally assign a unique number to your browser or device that has no meaning outside our Site. We use them to tailor your experience, including language and currency preferences, and to help provide content relevant to your interests. Once you enter your email address and password during a Website session, we retain that information so you do not have to enter it repeatedly in the same session. Where you agree, this may extend to future automatic logins. Most browsers accept cookies automatically. You can manage information collected through cookies or equivalent technology through browser or mobile-device settings. We are committed to giving you choices over privacy and sharing.
However, we do not recognise or respond to browser-initiated Do Not Track signals because industry-wide Do Not Track standards, implementations, and solutions have not been fully developed.
OTHER PURPOSES
In accordance with our legitimate interests, we may need to use and retain Personal Information for loss prevention and to protect our rights, privacy, safety, or property, or those of other people.
AUTHORIZED DISCLOSURES OF PERSONAL DATA TO THIRD PARTIES
Without limiting any other part of this Privacy Policy, we may share Personal Data about you with authorised third parties or relevant competent authorities inside or outside the EU/EEA where Data Protection Laws and/or other applicable law permit or require disclosure.
Authorised third parties may include, without limitation, entities within The Company, other third parties, law-enforcement agencies, collaborating accounting and auditing firms, regulators, relevant authorities, and digital-marketing providers. We may also share Personal Data with organisations that introduced you to us; third parties you have asked or allowed us to share data with; and any other party with whom disclosure is necessary to provide requested products and/or services. The data shared depend on the product(s) and/or service(s) you choose.
When Personal Data must be transferred outside the EEA – European Economic Area, we ensure that all necessary and appropriate safeguards are in place. We may also disclose Personal Information to associated or subsidiary companies, business partners, or successors in title to our business.
The section below explains how transfers outside the EEA are handled. Your Personal Data will never be shared with third parties for their marketing purposes unless you consent.
SHARING OF PERSONAL DATA WITH OTHER CATEGORIES OF RECIPIENTS
Where appropriate and always in accordance with Data Protection Laws, relevant data may also be disclosed or shared with Company members and staff, other entities within The Company, including where necessary to meet legal obligations, affiliated entities, and/or subcontractors for purposes listed in this Privacy Policy. This includes service providers enabling Site functions and/or services you request. We share Personal Information only to provide requested services or for another lawful reason, including authorised disclosure that does not require your consent.
Every authorised disclosure is made in accordance with Data Protection Laws. For example, all processors are contractually bound by Data Protection Laws, including a strict duty to keep received information confidential and ensure their employees/personnel are subject to similar duties. Those service providers, our processors, are also subject to other obligations, especially those in Article 28 of the GDPR.
Your Personal Data will never be shared with third parties for their own marketing purposes unless you consent.
INTERNET COMMUNICATIONS
Information sent over the internet may cross international borders even when sender and recipient are in the same country. We are not responsible for an act or omission by you or a third party concerning Personal Data before we receive it. This includes transfer of data from you to us through a country whose data-protection level is lower than that in the European Union, through any technology, such as WhatsApp, Skype, or Dropbox.
We also accept no responsibility or liability for data security while data are in transit over the internet unless a law effective in Curacao expressly makes us responsible.
ACCURACY OF YOUR PERSONAL DATA
We make all reasonable efforts to keep Personal Data we hold about you current and accurate. You may check the information we hold at any time by contacting us as explained below. If you identify an inaccuracy, we will correct it at your request. A detailed list of your rights under applicable data-protection law appears below.
LINKS TO THIRD PARTY SITES
Any third-party Website links we provide are clearly marked. We are not responsible for, and cannot be regarded as endorsing, the content of those websites, including their privacy policies or any data-processing activity. We recommend that you read every third party website’s privacy policy.
DATA TRANSFER OUTSIDE OF THE EEA
Data security is our highest priority. We have adopted suitable technical and organisational measures to protect the data we collect. Your Personal Data are stored on secure servers maintained by certified, reputable service providers.
Your Personal Data are mainly stored and processed within the EEA. However, as described above, we may share them with certain third parties that may access or store them. Some may process Personal Data as sub-processors outside the EEA. Staff or agents working for us outside the EEA may also access and process Personal Data.
Whenever Personal Data are transferred in this way, we ensure appropriate safeguards exist and that enforceable data-subject rights and effective legal remedies are available. We rely on standard contractual clauses and/or other suitable legal grounds. You may receive a copy of these safeguards by contacting us at LiveChat. We contractually require all processors to meet strict security standards delivering the same level of Personal Data protection as within the EEA.
By accepting this Policy, you specifically agree and opt-in to transfers of your Personal Data outside the EEA as described in this Policy.
DATA SUBJECT RIGHTS
The Company will assist you as effectively as possible if you choose to exercise rights relating to Personal Data. In certain cases, we may need to verify your identity before handling your request.
Right of Access
On request, we will confirm whether we process Personal Data about you. If we do, you may access that data and the following information:
1. The Personal Data we hold;
2. The reason we process it;
3. The parties to whom we disclose it;
4. How long we intend to retain it, where possible;
5. Whether we transfer it abroad and the safeguards used to protect it;
6. Your rights;
7. How to submit a complaint;
8. The source of your Personal Data; and whether we have carried out automated decision-making, including profiling, together with relevant information.
Right to rectification
You may ask us to correct and/or complete Personal Data about you that are inaccurate or incomplete.
Right of erasure (the “right to be forgotten”)
You may request deletion of Personal Data, and we will comply without undue delay where:
1. The Personal Data are no longer needed for the purpose for which they were collected;
2. You have withdrawn consent, where processing relies on consent, and no other legal basis applies;
3. You have successfully exercised your right to object, as described below;
4. Your Personal Data were processed unlawfully;
5. We are subject to a legal obligation; or
6. Special circumstances apply in connection with certain children’s rights.
In all cases, we are not legally obliged to comply with an erasure request where processing Personal Data is necessary to meet a legal obligation imposed on us.
Right to Restriction of Processing
You may request restriction of the processing of Personal Data, but only where:
1. You contest the accuracy of Personal Data, for the period needed to verify its accuracy;
2. Processing is unlawful and you oppose erasure;
3. We no longer need the Personal Data for the collection purpose, but you need it to establish, exercise, or defend legal claims; or
4. You have exercised the right to object and verification of our legitimate grounds to override your objection is pending.
If you successfully exercise this right, we may process Personal Data only:
1. With your consent;
2. To establish, exercise, or defend legal claims;
3. Where we no longer need the Personal Data for the purpose for which they were collected;
4. To protect another natural or legal person’s rights; or
5. For important public-interest reasons.
Right to Data Portability
You may ask us to provide Personal Data that you previously supplied to us. We will provide it in a structured, commonly used, machine-readable format or, where technically possible, transmit it directly to another Data Controller, provided this does not adversely affect others’ rights and freedoms. You may exercise this right only where:
1. Processing is based on your consent or performance of a contract with you;
2. Processing is carried out by automated means.
Right to Withdraw Your Consent
You may withdraw consent at any time. For more information, see the “DATA PROCESSING ON THE BASIS OF YOUR CONSENT” section above.
Right to object to the data processing
In certain cases, you may object to processing of Personal Data. We process Personal Data for one of the following purposes:
1. Processing is required for a task carried out in the public interest;
2. Processing is required for legitimate interests pursued by us or a third party. Processing will cease only where the Data Controller has not shown compelling and legitimate grounds that outweigh your objection and require continued processing.
If Personal Data are processed for direct marketing, you may object at any time.
Except for the situations above, this general right to object does not apply.
Right to lodge a complaint
As a Data subject, you may file a complaint at any time with a relevant Data Protection Supervisory Authority if you believe the Company has infringed your rights.
Despite that right, we kindly ask you to try to resolve issues with us before lodging a complaint. Please also note that the Company may still refuse a request where it can reasonably justify that decision. A refusal does not prevent you from filing a complaint with the relevant data-protection authority.
OUR CONTACT INFORMATION
If you have privacy questions or comments, or want to exercise an individual right, contact us. The Company’s Data Protection Officer can be contacted directly at LiveChat.