GoldenRoo Privacy Policy

1. About This Policy

The Company uses this Privacy Policy (the “Policy”) to explain its treatment of information and Personal Data supplied by you or collected by us. Handling this information enables us to maintain and manage our relationship with you.

GoldenRoo websites, applications, products and/or services fall within this Policy where they link to it or have no separate privacy policy. Throughout this document, these are referred to as our services.

Here you can find an explanation of the data we gather, the reasons for collection, our processing practices and the organisations that may receive the information. The Policy also addresses your rights concerning those activities and other relevant aspects of privacy and security.

“Company”, “we”, “us” and “our”, including variations of these words, identify the Data Controller referred to in this document. Reading the Policy constitutes acknowledgement and understanding that your Personal Data may be processed in the ways described. If you disagree with its provisions, please do not visit or use the Website or otherwise provide Personal Information to us.

Legislation Governing Processing

All Company processing envisaged here is carried out in accordance with the National Ordinance on the Protection of Personal Data (the “DPA”) and subsidiary legislation issued under it, including amendments made from time to time.

We also follow Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, concerning the protection of natural persons with regard to processing Personal Data and the free movement of such data, and repealing Directive 95/46/EC. This is the General Data Protection Regulation (the “Regulation” or “GDPR”).

References to “Data Protection Laws” mean the DPA and GDPR collectively. The Company decides the purposes and means of processing and is therefore the Data Controller for the purposes of the applicable Data Protection Laws.

2. Meaning of Key Terms

Data Controller

A controller may be an individual, legal person, public authority, agency or another body. Acting independently or together with others, it determines the purposes and means of Personal Data processing. If Union or Member State law establishes those purposes and means, that law may specify the controller or the criteria used to nominate it.

Data Processor

This term describes a natural or legal person, public authority, agency or other body processing Personal Data on behalf of a controller.

Personal Data

Information that identifies you individually, or that relates to an identified or identifiable natural person, is Personal Data. Such a person may also be described as a data subject.

3. How Information Is Secured

Protected remittances use TLS 1.2, the secure internet communication protocol adopted by the Company. Personal Data transmitted over the internet are encrypted through this protocol. We also maintain digital Personal Data on encrypted hard drives as an additional protection.

Our registration with site identification authorities allows your browser to verify the identity of our services before personally identifiable information is transmitted. Advanced firewall technology helps protect that information on our secure servers.

4. Standards for Personal Data Protection

Security procedures and systems meeting the highest industry standards protect the Personal Data we retain. Our approach combines quality and high standards with effective application of the law. We are bound to process information only where a genuine and legitimate reason is supported by a legal ground established under the GDPR.

5. Our Legitimate Interests

A commercial or business reason for processing information can give rise to a legitimate interest. When we act on that basis, we undertake to safeguard all your Personal Data and the manner of processing, ensuring that it does not treat you or your interests unfairly.

If legitimate interests become the basis for processing, we will notify you, explain the interests involved and make a procedure available for questions and objections. We do not have to discontinue processing where the reasons for it override your right to object. Processing needed for anti-money laundering purposes is an example. The same applies when we observe binding requirements of Curacao law, because lawful operation forms part of our legitimate interests.

6. When We Rely on Consent

We may be permitted or obliged to process Personal Data on grounds other than consent. Consent is used where we cannot rely on a different legal ground, or decide not to do so. Alternative grounds include legitimate interests and compliance with a legal obligation.

Where consent supports processing, you can withdraw it at any time by the same means used to give it. Following withdrawal, we will decide whether continued processing is permitted or required under another legal ground and tell you if this applies. Operations completed before withdrawal are not invalidated by it.

7. Keeping and Removing Personal Data

Personal Data held by the Company receive the best protection possible and are used only for purposes compatible with Data Protection Laws and other relevant laws. The retention period is limited to what is necessary, taking the original collection purpose into account. The information concerned and the particular relationship with you, including its duration, determine that assessment.

We usually begin by establishing whether legislation permits or obliges us to keep a particular record for a specified period. Tax or corporate laws are examples. If such a period applies, we keep the information for the maximum duration indicated by that law. Data regarded as transactional must, for example, be retained for at least five (5) years.

We must also assess whether you or a third party could rely on a law or contractual provision to bring an action against us. The relevant prescriptive periods are usually five (5) years. Records that could be needed to defend a claim, challenge or similar action will be retained for as long as necessary.

Information we no longer require will be deleted securely or anonymised.

If necessary Personal Data are withheld, the Company may be unable to discharge legal, regulatory or contractual obligations. It may also be unable to perform the services required for proper account administration and maintenance. Certain products or services may consequently be unavailable.

8. Categories of Information Collected

The categories below describe the Personal Data we process. A single category can be used for several purposes and under more than one legal ground.

Contact Details

These can include your given name and surname, residential mailing address and postcode, telephone or mobile number, email address and a recent utility bill displaying your residential address.

Identity Details

This category can include your name and surname, address, date of birth, identity card or passport number, photograph, gender, occupation, marital status, family details and hobbies.

Account and Website Activity

We process information about sign-ins, activity and transactions on the Website. This may cover all bets, winnings, bonuses received, payments and withdrawals, analytics, some browsing history, preferred games or bet types, time spent on particular pages, clicks, actions and cookies. Telephone, email and live-chat exchanges with customer services, together with information about self-exclusion from our services, are also included.

Technical Information

Traffic data, GeoIP location and information obtained from your browser, computer or mobile device when accessing or using our services fall within this category. Device and network details are examples.

Financial Records

Financial information includes currency, credit card details, banking details, other payment information and the source of funds.

Marketing and Educational Records

These may include your name and surname, mailing address, telephone or mobile number and email address. We may also process evidence of opt-in consent where necessary, records of objections to marketing, Website information and online identifiers such as an IP address or other browser-generated data.

9. Reasons for Using Your Information

We create a customer record and register you in our system, verify your identity and help prevent fraud, including attempts by others to impersonate you with your personal details.

We process information to provide additional safeguards for personal and credit data and for credit card use. It also supports the provision of assistance and protection against gambling addiction problems.

Managing and monitoring our ongoing relationship requires information so that we can deliver sports betting, casino games and our full customer care services. Processing also enables newsletter and campaign subscriptions and additions to mailing lists.

We use data to respond to requests and provide information concerning your profile, personalise your experience and maintain a responsible gaming environment. Up-to-date records of past enquiries, questions and complaints help us improve the service.

Monitoring deposits and withdrawals helps prevent unlawful use by third parties. We additionally process information to supply marketing you have requested or that we may otherwise lawfully send, as well as educational materials, upcoming-event notifications and related information useful for the services received or for educational purposes.

10. Grounds for Processing and Information Checks

Legal Bases

Processing relies on contractual necessity, legitimate interests, gambling licence requirements, anti-money laundering and KYC regulations, your consent where required or for direct marketing, and Responsible Gaming regulations.

The legitimate interests concerned include maintaining accurate system records, providing requested information, and developing and delivering innovative gaming and betting experiences on an ongoing basis.

Public Sources

Publicly accessible material, including web searches, company registers and broadcast media, may also supply Personal Data. We collect from these sources only where reasonable and not detrimental to your rights and freedoms.

Profiling and Verification

Certain data are used in checks that help build your account profile. Profiling involves automated processing required to comply with AML directives and prevent other fraudulent activity involving your details. Tax evasion and suspicious betting patterns are examples of the activities concerned.

No decision will be made automatically, including for marketing. Although IP address checks or PEP checks may be automated, the final decision is always taken by our human staff. We also verify email addresses by sending a message asking you to confirm your own address.

11. Giving, Withdrawing or Refusing Consent

For the avoidance of doubt, consent is relied upon only in the limited circumstances where a different legal ground, such as our legitimate interests, cannot be used or is not selected. We never assume consent; it is obtained clearly and expressly from you.

YOU ARE ENTITLED TO WITHDRAW YOUR CONSENT AT ANY TIME, in the same manner as you originally provided it. A withdrawal may also be communicated in writing to the physical or email address referred to below.

After a withdrawal, we will determine whether an alternative basis legally authorises or obliges continued processing without consent. A legal obligation binding on us is one possible basis. If an alternative applies, you will be notified.

Providing requested Personal Data is something you may decline. If the information is necessary to supply a requested service, however, we may be unable to deliver that service without it. This is particularly relevant where consent is the only available processing ground. The legal bases explained above demonstrate that consent is not the sole ground on which we process information.

12. Cookies, Preferences and IP Addresses

When you visit the Site, some Personal Data are gathered automatically using cookies and similar technologies. Website use results in a cookie being stored on your computer. These tools typically allocate a unique number to a browser or device; that number has no meaning beyond our Site.

Cookies support personalisation, including language and currency preferences, and help provide content matching your interests. During a Website session, we save the email address and password information you have entered so that you do not need to enter it repeatedly. With your agreement, this can be extended to automatic logins in future sessions.

Browsers generally accept cookies automatically. You may manage collection through cookies and comparable technologies in your browser or mobile-device settings. Providing choices over privacy and sharing is part of our commitment to you.

We neither recognise nor respond to browser-initiated Do Not Track signals, since the internet industry has not fully developed standards, implementations and solutions for them. More information is available at allaboutdnt.com.

Some Website features may stop being available if you do not accept cookies. IP addresses may also be used to identify you, administer the Website and assist with diagnosing server problems.

13. Further Uses of Information

We may need to keep and use personal information to prevent losses and protect our rights, privacy, safety or property, or those of others. These uses are based on our legitimate interests.

14. Permitted Disclosures to External Parties

Without prejudice to the other terms of this Policy, your Personal Data may be shared with authorised third parties or relevant competent authorities situated inside or outside the EU/EEA. Disclosure takes place where allowed or required by Data Protection Laws and/or other applicable legislation.

Recipients can include, but are not limited to, Company entities, other organisations and third parties, law enforcement agencies, collaborating accountants and auditors, regulators, relevant authorities and digital marketing providers. We may also share with organisations that introduced you to us, parties you asked or permitted us to share with, and parties that must receive information for us to deliver requested products or services. The product or service selected determines the Personal Data disclosed.

Necessary and appropriate safeguards are ensured whenever information is transferred beyond the European Economic Area (EEA). Associated or subsidiary companies, business partners and successors in title to our business may also receive personal information.

The arrangements for transfers outside the EEA are explained in section 19. We will never disclose your Personal Data to a third party for its own marketing without your consent.

15. Internal Recipients and Service Providers

Where appropriate, relevant information may also be shared with members and staff of the Company, other Company entities, affiliated entities and/or subcontractors for a purpose set out here. Examples include sharing within the Company to fulfil legal duties and disclosures to providers supporting Website functionality or another service you need. All such sharing follows Data Protection Laws.

Personal information is disclosed only to provide services you request or for another lawful reason, including authorised disclosures that do not depend on consent.

Our processors are bound by contract to observe Data Protection Laws. Their duties include strict confidentiality for information received and equivalent obligations for their employees and personnel. They must also meet additional requirements, especially those imposed by Article 28 of the GDPR.

Consent remains necessary for any sharing with outside parties for their own marketing purposes.

16. Information Sent over the Internet

An internet transmission may cross international borders even if its sender and recipient are in one country. Before Personal Data reach us, actions or omissions by you or any third party in connection with them are not our responsibility. This includes, without limitation, transfers routed through countries with lower data protection standards than the European Union, using any technological means, such as WhatsApp, Skype or Dropbox.

We do not accept responsibility or liability for the security of information in transit online unless a law effective in Curacao expressly places that responsibility on us.

17. Accuracy and Updates

Reasonable efforts are made to keep the Personal Data we hold current and as accurate as possible. You can check those records at any time by contacting us through the method described below. If you identify errors, we will correct them upon request. Your legal rights under applicable data protection law are set out in section 20.

18. Third-Party Websites

Any link we provide to another party’s website is clearly marked. We bear no responsibility for its content and do not endorse it, including its privacy policy or any data processing operations. We encourage you to read the privacy notice of each external site you visit.

19. Processing Beyond the European Economic Area

We place the highest priority on the security of your data. Suitable technical and organisational measures safeguard collected information, and all Personal Data are stored on secure servers maintained by reputable, certified service providers.

The EEA is the principal location for storage and processing. Nevertheless, recipients described above may store or access shared information, and some may process it as sub-processors outside the EEA. Employees or agents working for us outside that area may also access and process Personal Data.

Whenever these transfers occur, we ensure appropriate safeguards, enforceable data subject rights and effective legal remedies. Standard contractual clauses and/or other suitable legal grounds support these protections. You may request a copy of the safeguards through LiveChat. Contracts bind all processors to strict security standards maintaining the same level of Personal Data protection as within the EEA.

Your acceptance of this Policy specifically constitutes agreement and opt-in to the transfers outside the EEA described here.

20. Rights over Your Personal Data

The Company undertakes to provide the best assistance possible when you choose to exercise a Personal Data right. In some situations, we may need to establish your identity before acting on the request.

Access to Information

On request, we will confirm whether Personal Data concerning you are being processed. If so, we will give you access and explain what data we hold, why we process them, their recipients and, where possible, how long we intend to retain them.

Access information also covers overseas transfers and safeguards, your rights, how to complain, where the data originated, and whether automated decision-making, including profiling, has been carried out, together with the associated information.

Correction and Completion

You can ask for inaccurate Personal Data to be rectified and incomplete Personal Data to be completed.

Deletion — the Right to Be Forgotten

You may request erasure, which we will perform without undue delay if:

• The original collection purposes no longer require the information.
• Consent has been withdrawn, where it was our processing ground, and no other lawful basis exists.
• An objection made under your right to object has been successful.
• Processing of the information was unlawful.
• A legal obligation binding on us requires deletion.
• Particular circumstances relating to certain children’s rights apply.

Where processing is required for compliance with a legal obligation imposed on us, we are not legally bound to grant an erasure request.

Restricting Processing

This right can be exercised only in the following cases: accuracy is disputed, for the time needed to verify it; processing is unlawful and you oppose erasure; the information is no longer needed for our original purposes but you require it to establish, exercise or defend legal claims; or you have objected and assessment of whether our legitimate grounds override your objection remains pending.

Once restriction is successfully requested, we may process your information only with your consent; to establish, exercise or defend legal claims; where we no longer need it for the purposes for which it was collected; to protect the rights of another natural or legal person; or for reasons of important public interest.

Receiving or Transferring Your Data

You can request the Personal Data previously supplied by you in a structured, commonly used and machine-readable format. If technically feasible, we may instead transmit the data directly to another Data Controller, provided others’ rights and freedoms are not adversely affected.

Data portability is available only when processing is automated and its basis is either consent or performance of a contract with you.

Withdrawing Permission

Consent can be withdrawn at any point. See section 11, “Giving, Withdrawing or Refusing Consent”, for the fuller explanation of this right.

Objecting to Processing

Certain processing may be challenged by an objection. This applies to processing necessary for a task in the public interest and processing necessary for legitimate interests pursued by us or a third party. In the latter case, processing stops only where the Data Controller has not demonstrated compelling legitimate grounds that outweigh your objections and require continuation.

You can object at any time to the processing of your information for direct marketing. Apart from the circumstances described above, this general objection right does not apply.

Making a Complaint

If you believe the Company has infringed your rights, you may lodge a complaint with a relevant Data Protection Supervisory Authority at any time. Without affecting that entitlement, we ask you to attempt to settle your concerns with us first.

The Company may refuse a request despite the rights described here if it can reasonably justify the decision. Such a refusal leaves you free to complain to the relevant data protection authority.

21. Privacy Enquiries and Contact

Please get in touch if you want to exercise an individual right or raise a privacy question or comment. Our customer service team can also help with the assistance you require.

Direct contact with the Company’s Data Protection Officer is available through LiveChat.