1. Introduction
This Privacy Policy explains how personal data is collected, used, stored, shared and protected in connection with Genting Casino Cromwell Road. It applies to individuals who visit the premises, use the services or interact with the company in any capacity, and covers all personal data processing activities where Genting Casino Cromwell Road acts as data controller.
Processing of personal data is carried out in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where processing activities relate to gambling services, they are also conducted in line with requirements set by the UK Gambling Commission.
Questions about this Privacy Policy or requests to exercise data subject rights should be sent to the Data Protection Officer (DPO) at [email protected].
2. Data Collected
Personal data is collected and processed in several categories depending on how an individual interacts with the company.
Category - Examples of data collected
Identity data - Full name, date of birth, gender, photographic identification
Contact data - Postal address, email address, telephone number
Account data - Username, account history, preferences, login records
Financial data - Payment card details, transaction records, source of funds information
Verification data - Copies of identity documents submitted for KYC and AML checks
Responsible gambling data - Self-exclusion status, deposit limits, time-out settings, GAMSTOP registration
Technical data - IP address, browser type, device identifiers, session data
Communications data - Records of correspondence with support or compliance teams
Personal data relating to individuals under the age of 18 is not knowingly collected. If it becomes apparent that data has been collected from a minor, steps are taken to close the relevant account and delete the data without undue delay, subject to any legal or regulatory obligations to retain it.
3. Methods of Data Collection
Personal data is collected through the following methods:
- Direct interactions: when an individual registers an account, visits the premises, completes verification forms, contacts support, or responds to communications.
- Automated technologies: when digital services are accessed, certain technical data is collected automatically through cookies and similar tracking tools.
- Third parties: data may be received from identity verification providers, fraud prevention agencies, credit reference agencies and regulatory bodies where required or permitted by law.
4. Purposes and Legal Bases for Processing
Personal data is processed only where there is a lawful basis under Article 6 of UK GDPR. The primary purposes and corresponding legal bases are:
Purpose - Legal basis
Account registration and management - Performance of a contract (Article 6(1)(b))
Identity verification and KYC checks - Legal obligation (Article 6(1)(c))
Anti-money laundering compliance - Legal obligation (Article 6(1)(c))
Fraud detection and prevention - Legitimate interests (Article 6(1)(f))
Responsible gambling monitoring - Legal obligation (Article 6(1)(c))
Regulatory reporting to the Gambling Commission - Legal obligation (Article 6(1)(c))
Marketing communications (where consented) - Consent (Article 6(1)(a))
Improving and securing services - Legitimate interests (Article 6(1)(f))
Where consent is relied upon as the legal basis, it may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
5. Data Sharing and Disclosure
Personal data is not sold to third parties. It may be shared with the following categories of recipients where necessary and lawful:
- Regulatory and law enforcement authorities, including the UK Gambling Commission and the Information Commissioner’s Office (ICO), where required by law or in response to a lawful request.
- Identity verification and KYC service providers engaged to assist with legal compliance obligations.
- Fraud prevention and AML screening agencies.
- Payment processors and financial institutions involved in processing transactions.
- Group companies within the Genting group, where processing is carried out on behalf of Genting Casino Cromwell Road or in connection with shared compliance functions.
- Professional advisers, including legal counsel, auditors and insurers, where required for the conduct of business or handling of disputes.
All third parties receiving personal data are required to handle it in accordance with applicable data protection law and relevant contractual obligations.
6. Data Retention
Personal data is retained for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory, accounting and reporting obligations.
In practice, this includes:
- Account and transaction data retained for a minimum of five years following account closure or the last transaction, in line with anti-money laundering obligations under the Proceeds of Crime Act 2002 and associated regulations.
- Responsible gambling records, including self-exclusion data, retained for the period required by Gambling Commission licence conditions.
- Data held in connection with a legal dispute retained for the duration of the dispute and for six years thereafter.
When data is no longer required, reasonable steps are taken to delete or anonymise it securely, subject to any legal or regulatory obligations to retain it.
7. Rights Under UK GDPR
Individuals have the following rights in relation to their personal data, subject to the conditions and exemptions set out in UK GDPR and the Data Protection Act 2018:
- Right to be informed: to receive clear information about how personal data is used, as set out in this Privacy Policy.
- Right of access: to request a copy of the personal data held (a Subject Access Request).
- Right to rectification: to request correction of inaccurate or incomplete personal data.
- Right to erasure: to request deletion of personal data in certain circumstances. This right may be limited where there is a legal obligation to retain data, including under AML and gambling regulation.
- Right to restriction of processing: to request that the use of personal data is limited in specific situations.
- Right to data portability: to receive personal data in a structured, commonly used and machine-readable format, where processing is based on consent or contract and is carried out by automated means.
- Right to object: to object to processing based on legitimate interests, including profiling for direct marketing purposes.
- Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact the Data Protection Officer at [email protected]. Responses to verified requests are provided within one calendar month. In complex cases, this period may be extended by up to two further months; in such cases the requester will be informed of the extension and the reasons for it.
8. Cookies and Tracking Technologies
Cookies and similar technologies are used on digital platforms associated with Genting Casino Cromwell Road to support operation, functionality and security, and, where consent is provided, for analytics and marketing purposes.
Cookie preferences can be managed through the settings available on the relevant website or application. Withdrawal of consent for non-essential cookies does not affect access to core services but may impact certain features or functionalities.
9. Complaints
Any individual who is dissatisfied with the handling of their personal data has the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters.
ICO contact details:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113
Before contacting the ICO, individuals are encouraged to raise the matter with Genting Casino Cromwell Road so that the concern can be addressed directly where possible.
10. Changes to This Policy
This Privacy Policy is reviewed periodically and updated when necessary to reflect changes in processing activities, legal requirements or regulatory guidance. The current version of the policy is made available on the Genting Casino Cromwell Road website or on request.
Continued use of the services after any update to this Privacy Policy constitutes acknowledgement of the revised terms.
11. Contact
For all data protection enquiries, rights requests or concerns relating to this Privacy Policy, contact:
Data Protection Officer
Genting Casino Cromwell Road
Email: [email protected]