Privacy Policy GoldenRoo Casino

Scope

This Privacy Policy, referred to below as the “Policy”, describes GoldenRoo Casino handling of information and Personal Data received from you or gathered by us in order to administer our relationship with you effectively.

It applies to GoldenRoo websites, applications, products, and/or services that link to this Policy or lack their own separate privacy policy. These are collectively described as our services.

The Policy is intended to help you understand the information we obtain, our reasons for collecting it, the ways we use it, and the parties to whom it may be disclosed. It also explains your rights over the collection, processing, and sharing of that information and other matters affecting privacy and security.

The terms “Company”, “us”, and “our”, and their grammatical forms, refer to the Data Controller covered by this Policy.

By reading this document, you acknowledge and understand that your Personal Data may be handled as described here. If these terms are unacceptable to you, do not use the Website or otherwise give us your Personal Information.

Every processing activity undertaken by the Company under this Policy will follow the National Ordinance on the Protection of Personal Data (the “DPA”) and any subsidiary legislation issued under it, as each may be amended.

Processing will also follow Regulation (EU) 2016/679 of the European Parliament and of the Council, dated 27 April 2016, on the protection of natural persons with regard to Personal Data processing and the free movement of such data, repealing Directive 95/46/EC. This is the General Data Protection Regulation, referred to as the “Regulation” or “GDPR”.

Together, the DPA and GDPR are called the “Data Protection Laws”. The Company acts as the Data Controller under those laws because it establishes the purposes and methods of Personal Data processing.

Definitions

Data Controller

The Data Controller is the natural or legal person, public authority, agency, or other body deciding, alone or together with others, the purposes and means of processing Personal Data. If Union or Member State legislation sets those purposes and means, that legislation may identify the controller or specify the criteria for appointing one.

Data Processor

A Data Processor is a natural or legal person, public authority, agency, or other body handling Personal Data on the controller’s behalf.

Personal Data

Personal Data consist of information identifying you individually or relating to an identified or identifiable natural person, otherwise referred to as a data subject.

Security

For protected remittances, the Company has implemented TLS 1.2, a secure internet communication protocol. It encrypts your Personal Data during online transmission. As a further security measure, digital Personal Data are stored on encrypted hard drives.

Registration of our services with site identification authorities enables your browser to confirm who we are before transmitting personally identifiable details. Our secure servers also use advanced firewall technology to protect that information.

Personal Data Protection

The information we hold is secured through systems and procedures reflecting the highest industry standards. Protecting it requires not only high quality and strong standards, but effective application of the law. We process Personal Data only for a genuine and legitimate reason supported by a legal basis recognised in the GDPR.

Processing on the Basis of Our Legitimate Interests

A business or commercial reason for handling Personal Data can constitute a legitimate interest. In relying on such an interest, we commit to safeguarding all your information and the way it is processed, ensuring that the activity is not unfair to you or your interests.

Whenever we decide to use this legal basis, we will tell you that we are doing so, explain the interests concerned, and give you a means of raising questions or objections. The Company does not have to cease processing if its grounds take precedence over your right to object. Processing required for anti-money laundering purposes is one example. The same principle applies when we meet binding obligations under Curacao law, since lawful operation is among our legitimate interests.

Processing on the Basis of Your Consent

Consent is not the only basis that may permit or require us to process information. We use it where an alternative ground, such as compliance with law or legitimate interests, is unavailable or where we elect not to rely on that alternative.

When consent is the basis, you may withdraw it whenever you choose, in the same way you originally gave it. We will then establish whether another legal ground permits or obliges us to continue handling your information and inform you if one applies. Processing completed before the withdrawal remains valid.

Data Retention Policy

The Company will protect retained Personal Data as effectively as possible and use them only for purposes compatible with Data Protection Laws and other applicable legislation. Retention lasts only as long as necessary, taking account of the purpose for which the information was first obtained. The assessment depends on the particular data and our relationship with you, including how long that relationship lasts.

We normally first establish whether specific legislation, such as tax or corporate law, authorises or requires us to keep particular information for a set period. In those circumstances, we retain it for the maximum period stated by that law. Transactional data, for instance, must remain on record for at least five (5) years.

We must also examine whether you or another party could bring an action against us under a law or contractual term and identify the relevant prescriptive period, generally five (5) years. Information relevant to defending claims, challenges, or comparable actions will be kept for the necessary time.

Once retention is no longer required, the information will be securely erased or anonymised.

Not providing Personal Data can prevent us from complying with legal and regulatory requirements, meeting contractual commitments, or delivering the services necessary to manage and maintain your account. Consequently, a failure to supply required information may mean that some products and/or services cannot be provided.

Personal Data We Collect, Processing Purposes and Legal Bases

The sections that follow explain the categories of data handled, the purposes for which they are used, and the legal bases for doing so. One category may be used for several purposes, with different legal grounds applying to those uses.

Categories of Personal Data

Contact data include, for example, your name and surname, residential postal address with postcode, telephone or mobile number, email address, and a recent utility bill displaying your home address.

Identity data include, for example, your name and surname, address, birth date, identity card or passport number, photograph, gender, occupation, marital and family status, and hobbies.

Activity data include your Website logins and what you do or transact on the Site. Examples are all wagers, winnings, bonuses, payments, account withdrawals, analytics information, some browsing history, favourite games or bet types, time on individual pages, clicks, actions, and cookies. This also covers conversations with customer services by phone, email, or live chat and information about self-exclusion from our services.

Technical data comprise traffic data, GeoIP location, and details supplied by your browser, computer, or mobile device while accessing or using our services, including device and network information.

Financial data cover currency, credit card and bank information, alternative payment details, and the origin of funds.

Data for marketing and educational purposes may comprise your name and surname, postal address, telephone or mobile number, email address, evidence of consent to opt in when required, records of marketing objections, Website data, and online identifiers. These identifiers include IP addresses and other information produced by your browser.

Purpose of Data Processing

We use data to establish your record in our system and register you as a customer, verify your identity, and prevent potential fraud, including impersonation by others using your information.

We also process data to give additional protection to your personal and credit information and to your use of a credit card.

Another purpose is to provide assistance and protection in relation to gambling addiction problems.

Processing enables us to monitor and administer our continuing relationship, supply sports betting and casino gaming services, and deliver full customer support.

Information is also used for newsletter and campaign subscriptions and for adding you to mailing lists.

We handle data to provide information concerning your profile and requests, tailor your customer experience, and support a responsible gaming environment. Maintaining current records of previous enquiries, complaints, and questions also helps us improve our services.

Deposits and withdrawals are monitored to prevent unlawful third-party use.

We use information to send marketing materials you request or that we are otherwise permitted to provide. It also supports the delivery of educational content, announcements of forthcoming events, and other related information useful in connection with the services you receive or for educational purposes.

Legal Basis for Data Processing

The legal grounds we rely on are contractual necessity, legitimate interests, gambling licence requirements, anti-money laundering and KYC regulations, consent where required or for direct marketing, and Responsible Gaming regulations.

Legitimate interests include maintaining accurate system records, answering requests for information, and consistently developing and providing innovative gaming and betting experiences.

The Company may additionally obtain Personal Data from public sources, for example web searches, company registers, and broadcast media, where reasonable and not harmful to your rights or freedoms.

Some information contributes to checks used in profiling your account. Profiling comprises automated Personal Data processing undertaken to follow AML directives and prevent other fraudulent use of your personal details, such as tax evasion or suspicious wagering patterns.

Decisions will not be made automatically, including decisions for marketing purposes. The system may carry out automatic checks of IP addresses or PEP status, for example, but a member of our staff always makes the final decision. Email verification is also performed: an email will be sent asking you to confirm your address.

Data Processing on the Basis of Your Consent

For clarity, we rely on consent in the limited cases where another legal ground, such as a legitimate interest, is not available or is not the ground we choose to use.

Consent will never be presumed. We will obtain it in a clear, express manner, and YOU HAVE THE RIGHT TO WITHDRAW YOUR CONSENT AT ANY TIME through the same means used to provide it.

If you withdraw consent, including by writing to the physical or email address referred to below, we will review whether an alternative basis exists at that point. For example, a legal obligation may authorise or require continued processing without consent. Where this is the case, we will advise you accordingly.

You can always decline a request for Personal Data. However, withholding information needed to deliver a requested service may make that service unavailable, especially if consent is the only legal basis on which we can act.

The other grounds described in the preceding section remain relevant: consent is not the sole basis that allows us to process your information.

Cookies

Cookies and similar technologies automatically collect certain categories of Personal Data when you visit the Site. Website use places a cookie on your computer. Typically, these technologies give your device or browser a unique number without significance outside our Site.

They enable personalisation, such as remembering language and currency choices, and help us deliver material suited to your interests. When you supply an email address and password in a Website session, those details are saved to avoid repeated entry during that session. If you agree, the arrangement may continue for automatic logins on later visits.

Automatic cookie acceptance is the default in most browsers. You can control collection through cookies or comparable technologies using browser or mobile-device settings. We are committed to offering ways to manage your privacy and information sharing.

Browser-initiated Do Not Track signals are not recognised or acted upon because industry standards, implementations, and solutions for them are not fully developed.

Some Website functions may be unavailable if cookies are refused. We may additionally use IP addresses for identification, Website administration, and investigation of server faults.

Other Purposes

Our legitimate interests may require us to retain and use personal information to prevent losses or protect the rights, privacy, safety, or property of the Company or other persons.

Authorised Disclosures of Personal Data to Third Parties

In addition to the other provisions of this Policy, your information may be shared with authorised outside parties or relevant competent authorities within or beyond the EU/EEA, where Data Protection Laws and/or other applicable laws allow or demand disclosure.

Potential recipients include, without limitation, entities within the Company, other third parties and organisations, law enforcement agencies, accounting and auditing firms working with us, regulators, relevant authorities, and digital marketing providers. Recipients may also include an organisation that referred you to us, a party you have asked or authorised us to disclose to, or a party that must receive information so we can deliver the products or services you request. What we disclose depends on the products and services selected.

Transfers beyond the European Economic Area (EEA) are subject to all necessary and appropriate safeguards. We may also disclose information to associated or subsidiary companies, our business partners, and successors in title to the business.

Further details of EEA transfers appear below. Disclosure to another party for its own marketing will never take place without your consent.

Sharing Personal Data with Other Categories of Recipients

Relevant information may also be disclosed, as appropriate and in accordance with Data Protection Laws, to Company members and employees, other entities within the Company, affiliates, and/or subcontractors where relevant to a purpose in this Policy. This includes intra-company disclosures for legal compliance and sharing with providers enabling Site functionality or services you require.

We disclose personal information only to fulfil requested services or for another lawful reason, including authorised disclosures for which consent is unnecessary.

These disclosures comply with Data Protection Laws. Each processor is contractually bound by their requirements, including strict confidentiality and the obligation to ensure that its employees and personnel are subject to equivalent duties. Processors must fulfil additional requirements as well, particularly those under Article 28 of the GDPR.

Your consent is required before your Personal Data can be shared with third parties for their own marketing.

Internet Communications

Online communications can travel across international borders even where both parties are in the same country. We cannot be responsible for acts or omissions by you or third parties concerning Personal Data before we receive them. This includes routing information through a country offering less protection than the European Union, using any technology, including WhatsApp, Skype, or Dropbox.

Nor do we accept liability or responsibility for data security while information travels over the internet, except where a law in force in Curacao explicitly makes us responsible.

Accuracy of Your Personal Data

We make reasonable efforts to keep your information correct and current. You may check what we hold at any time by contacting us as explained below. At your request, inaccuracies you identify will be corrected. The rights section below gives fuller details of your entitlements under applicable data protection legislation.

Links to Third-Party Sites

We clearly mark links leading to third-party websites. Their content is neither our responsibility nor endorsed by us, including their privacy policies and any form of data processing. Please review the privacy policies of websites reached through those links.

Data Transfers Outside the EEA

Data security is our highest priority. We use appropriate organisational and technical measures to secure collected information, and store all Personal Data on secure servers maintained by certified, reputable providers.

Storage and processing occur mainly inside the EEA. Information disclosed to the third parties described above may, however, be accessed or stored by those recipients. Some act as sub-processors handling information outside the EEA. Staff and agents working for us from outside the EEA may also access and process it.

Whenever a transfer takes place, we ensure suitable safeguards and the availability of enforceable data subject rights and effective legal remedies. We rely on standard contractual clauses and/or other appropriate legal grounds. A copy of the safeguards is available by contacting us through LiveChat. Our contracts require all processors to meet strict security standards that maintain a level of Personal Data protection equivalent to that within the EEA.

By accepting this Policy, you expressly agree and opt in to the transfers beyond the EEA described here.

Data Subject Rights

The Company will provide the best assistance it can when you choose to exercise a right relating to your information. We may have to verify your identity before handling a request.

Right of Access

You may ask us to confirm whether your Personal Data are being processed. If they are, we will provide access and information covering:

• The Personal Data held about you.
• The purposes for which they are processed.
• The recipients to whom they are disclosed.
• Their intended retention period, where it can be specified.
• Whether they are transferred abroad and the protective safeguards used.
• Your available rights.
• The procedure for making a complaint.
• The source of your information and whether automated decision-making, including profiling, has occurred, together with related details.

Right to Rectification

You may request correction of inaccurate Personal Data and/or completion of incomplete information concerning you.

Right to Erasure — the Right to Be Forgotten

You can ask us to delete your information. We will comply without undue delay where:

• It is no longer required for the purposes of collection.
• Consent has been withdrawn and, where consent was the processing basis, no other legal ground remains.
• You have successfully exercised your right to object, as described below.
• The information has been processed unlawfully.
• A legal obligation to which we are subject requires erasure.
• Special circumstances concerning certain children’s rights apply.

We need not comply with an erasure request if retaining and processing the information is necessary to satisfy a legal obligation imposed on us.

Right to Restriction of Processing

You can request restricted processing only in specific situations. These are when accuracy is disputed, for the time needed to verify it; when processing is unlawful but you oppose deletion; when our original need for the information has ended but you require it to establish, exercise, or defend legal claims; or when you have objected and a decision on whether our legitimate grounds override that objection is still pending.

If you successfully invoke this right, further processing is limited to circumstances where we have your consent; processing serves the establishment, exercise, or defence of legal claims; we no longer need the information for the collection purposes; another natural or legal person’s rights require protection; or important public interest reasons apply.

Right to Data Portability

Information you previously supplied may be requested in a structured, commonly used, machine-readable format. Where technically feasible, we may transfer it directly to a different Data Controller, so long as this does not adversely affect anyone else’s rights and freedoms.

This right is available only where processing is based on your consent or performance of a contract with you and takes place through automated means.

Right to Withdraw Consent

Consent may be withdrawn at any time. Further explanation appears above under “Data Processing on the Basis of Your Consent”.

Right to Object to Data Processing

In certain cases, you can object to processing performed for a task in the public interest or for legitimate interests pursued by us or a third party. Where legitimate interests are concerned, processing will cease only if the Data Controller has not supplied compelling legitimate grounds outweighing your objections and requiring its continuation.

For direct marketing, you may object to processing whenever you wish. This general right of objection does not extend to circumstances other than those set out above.

Right to Lodge a Complaint

If you believe the Company has infringed your rights as a data subject, you may submit a complaint at any time to a relevant Data Protection Supervisory Authority.

We ask, without limiting that right, that you first try to resolve any concerns directly with us. The Company may still decline a request where it can reasonably justify doing so. A refusal does not prevent you from approaching the relevant data protection authority with a complaint.

Contact Information

Contact GoldenRoo Casino with any privacy questions or comments or to exercise your individual rights. Our customer service team is also available to provide the assistance you need.

You can reach the Company’s Data Protection Officer directly through LiveChat.