Notice on the Processing of Personal Data of Olympic Casino Customer

Valid from: 09.09.2024

1.    General provisions

1.1.    This notice explains the processing of customers’ personal data by Olympic Casino casinos and the rights of customers in relation to the processing of personal data.
1.2.    The data controller is SIA Olympic Casino Latvia (turpmāk tekstā – OCL), Rēzeknes iela 5E, Rīga, LV-1073, +37167892975, latvia@oc.eu.
1.3.    The contact details of OCL’s Data Protection Officer are DataProtectionOfficerLatvia@oc.eu, +37167892975, Rēzeknes iela 5E, Rīga, LV-1073.
1.4.    OCL implements appropriate technical and organisational measures to protect personal data from unauthorised access, unlawful disclosure, accidental loss, alteration, destruction or other unlawful processing. We also require our cooperation partners, to whom we transfer personal data in accordance with this Privacy Notice, to implement the necessary organisational, physical and IT security measures. However, please note that even by using all technical and organisational measures to protect personal data, some risks, such as cyber-attack, loss of electricity, software error or malicious actions of an individual, still remain. Upon discovering such breach, we shall take all reasonable steps to mitigate and minimise the risk to our customers.
1.5.    Provisions on the processing of personal data may also be included in contracts between the customer and OCL. In such a case, in the event of a conflict of provisions, the provisions agreed upon in the contract shall apply.
1.6.    If OCL amends the notice on the processing of personal data, it will publish the updated version.

2.    Customer rights in relation to the processing of their personal data

2.1.    The customer has the right to be informed on whether OCL processes their personal data and, if so, to receive a copy of the aforementioned data.
2.2.    The customer has the right to request the rectification of inaccurate personal data concerning them.
2.3.    The customer has the right to withdraw their consent to the processing of personal data (e.g. direct marketing consent) at any time, if the processing is based on consent. Withdrawal of consent does not affect the lawfulness of the processing that took place prior to the withdrawal.
2.4.    The customer has the right to request the erasure of their personal data. OCL may delete data processed on the basis of consent or legitimate interest if the interests of OCL do not outweigh the interests of the customer. The right to erasure does not apply to data that is processed for the fulfilment of a legal or contractual obligation, as long as the legal or contractual obligation is valid.
2.5.    The customer has the right to object to the processing of their personal data (especially on the basis of legitimate interest) and to restrict the processing of their personal data where justified.
2.6.    The customer has the right to receive their personal data, which they have submitted, in a structured and machine-readable format (if technically feasible) for transmission to other companies.
2.7.    The Customer has the right to lodge a complaint about the processing of personal data with the Data State Inspectorate by sending an e-mail to pasts@dvi.gov.lv or in person at Elijas ielā 17, Rīgā, LV-1050.

3.    Processed personal data and their sources

3.1.    OCL processes the following customer personal data.
3.1.1.    Registration data: first name, last name, personal identification code or date of birth, photo of the person.
3.1.2.    Verification data: type of the identity document, number of the document, date of issuance and validity, copy of the document, result of the personal data check from the gambling self-exclusion list, the list of sanctioned persons and OCL’s casino exclusion list, country of residence.
3.1.3.    AML data: occupation or activity, country of residence, information on being a politically exposed person, source and origin of funds, details of transactions over 2,000 € (time, place, amount, description).
3.1.4.    Club reward card data: club reward card number, date of issue.
3.1.5.    Gambling data: name of the gaming venue, type and number of the gaming device, start and end time of the gaming session, details of the funds inserted during the session, the stake placed and the result of the game.
3.1.6.    Transfer data: IBAN of the bank account or the 4 final digits of the card number, the amount of the transfer or card payment, the place and time of the transaction.
3.1.7.    Marketing and communication data: e-mail and/or mobile phone number, language of communication, product/service preference, consent to direct marketing, message content, date and time of message.
3.1.8.    Visual data: visual image of the person, name of the gaming venue, camera number, date and time.
3.1.9.    Website visit data: IP address (including location based on IP address), Internet service provider, referrer URL, date, time, access token, session key, web browser type and version, operating system, amount and status of data transmitted, MAC address;
3.1.10.     Cookie data: OCL uses cookies on its websites to optimise the websites and their functions. Cookies may collect personal data. For more information, please consult OCL’s Cookie Policy
3.2.    OCL does not process special categories of personal data related to the customer (data concerning racial or ethnic origin, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, genetic data and biometric data).
3.3.    OCL collects data related to the customer from the customer, publicly available sources, and third parties such as public authorities, national databases and Acuris Risk Intelligence LTD, an intermediary of a database concerning the verification of politically exposed persons and sanctions.

4.    Legal basis and purposes of the processing of personal data

4.1.    The legal bases for the processing of the customer’s personal data are: performance of legal obligations, performance of contractual obligations, the data subject’s consent and the legitimate interest of OCL.
4.2.    The following is a list of processing activities and their legal basis:
4.2.1.    For performance of legal obligations, we process: registration data, verification data, AML data, gambling data, visual data;
4.2.2.    For performance of contract we process: registration data, gambling data, transfer data, club rewards card data;
4.2.3.    Based on consent, we process marketing and communication data, cookie data;
4.2.4.    Based of legitimate interests, we process: club rewards card data, visual data, gambling data, cookie data, website visit data, registration data.
4.3.    The purposes of processing the customer’s personal data are: administering customer database, fulfilling the customer’s registration obligation, fulfilling the obligation of registering the customer’s financial transaction, providing contractual information to the customer, fulfilling the "know your customer" requirement, fulfilling the obligation to verify persons with child maintenance arrears, providing gambling services, building loyalty and providing added value, handling the customer’s self-exclusion application, marketing OCL services/products, collecting and handling customer feedback, determining the customer’s risk profile, expanding the customer base, building customer loyalty and providing added value through the club reward card, claiming damages, complying with the terms and conditions of use of the payment terminal, maintaining the poker leaderboard, managing OCL’s resources, service improvement, monitoring work processes and staff, ensuring safety in the gaming rooms, archiving OCL documents, handling whistleblowing reports.
4.4.    In the case of data processing carried out for the performance of legal or contractual obligations, the customer is obliged to provide such personal data. Failure to provide such data will prevent OCL from fulfilling its contractual or legal obligations and will limit the customer’s ability to use the services offered.
4.5.    Where OCL processes personal data on the basis of legitimate interest, it has assessed that its legitimate interest in processing personal data for certain purposes outweighs the interests and rights of the customer.
4.6.    Where the personal data is processed based on the customer’s consent, then this consent can be withdrawn by contacting the data protection officer, whose contact details can be found in clause 1.3, or by clicking at the unsubscribe link at the end of every marketing message.

5.    Profiling and automated decision-making

5.1.    Profiling is used in the following processes and is based on the following logic.
5.1.1.    Marketing the services/products offered by OCL and OlyBet, taking into account the volume of customer visits, services and games used.
5.1.2.    Determining the risk profile of the customer, taking into account the customer’s last 365 days of visits, game and payment statistics. On the basis of the risk profile, OCL may ask for proof of the customer’s income, failing which OEG has the right to restrict the customer’s access to the services offered.
5.2.    Automatic decisions are used in the following processes and based on the following logic.
5.2.1.    Generating weekly freeplay for the club reward card user, taking into account the customer’s game turnover of the last 30 days.
5.2.2.    Upgrading a customer to the Bronze and Silver tier owing to rewards points is based on the customer’s previous 6 months’ game turnover.

6.    Transmission of personal data

6.1.    In order to provide services and/or to fulfil its legal obligations, OCL uses partners as personal data processors, who process data based on and to the extent of the instructions given by OCL.
6.2.    When processing personal data, OCL will transfer your personal data to the following recipients: public authorities, courts, banks, auditors and legal advisors, insurance companies, analytics service providers, archiving service providers, information transmission and communication service providers, PEP and sanction verification database intermediaries, poker tournament management software providers, live poker data base, streaming service intermediaries, whistleblowing platform operators, database operators, sports integrity organisations and unions.
6.3.    If the OCL partner processing the data is located outside the European Union, the safeguards to be used for the transmission of personal data are: an adequate level of data protection in the recipient country in accordance with the European Commission’s decision, or the use of standard contractual clauses for data protection developed by the European Commission in the cooperation agreement (click on the relevant link for more information).
6.4.    The joint controller of customer data is the OlyBet online gaming environment operator SIA Olybet Latvia (address Rēzeknes ielā 5E, Rīgā, LV-1073, +37167892975, latvia@oc.eu), which is part of the same group as OCL, with whom OCL processes customer data for the purpose of organising joint-campaigns, marketing services/products, sending communications (including direct marketing regarding OCL and OlyBet, depending on consent), sharing data between joint controllers for the joint management and provision of loyalty programs determining the customer’s risk profile and managing OCL’s resources. The parties have entered into an agreement to this effect, which allows the parties to share the personal data to achieve the purposes contained in this Privacy Notice.

7.    Time limits for the retention of personal data

7.1.    The personal data of a customer is retained until the purposes of the processing have been fulfilled or until the obligations arising from the legislation have been fulfilled.
7.2.    To comply with gambling, AML as well as accounting legislation, OCL must retain AML data (details of transactions over 2,000 €) for at least 5 years after the transaction. If the personal data is not deleted after 5 years from the last visit, then OCL has assessed that it has a legitimate interest in retaining all or part of the data, in which case OCL will not retain the relevant data for longer than OCL needs to fulfil its legitimate purposes. 
7.3.    Video surveillance recordings shall be retained for a minimum of 7 days but not more than 30 days.

8.    Video surveillance

8.1.    OCL uses video surveillance for security purposes in its offices, casinos and gaming venues. The entrance area of the offices, the entire customer zone, the cash desk, the bar and the area in front of the front door of the gaming venues are monitored by video surveillance systems.
8.2.    OCL uses video surveillance to fulfil its legal obligations to ensure the safety of visitors, employees and property, to detect and prevent illegal activities and to protect OCL’s legal claims.
8.3.    The CCTV images and recordings will only be viewed by OEG’s surveillance staff. If requested by law enforcement authorities, the recordings will also be transmitted to them.