Privacy Statement

Introduction

Casinos Austria Aktiengesellschaft (hereinafter “Casinos Austria”), Österreichische Lotterien Gesellschaft m.b.H. (hereinafter “Österreichische Lotterien”) with its online gaming platform (hereinafter “win2day”), Glücks- und Unterhaltungsspiel Betriebsges.m.b.H. (hereinafter “WINWIN”) and Österreichische Sportwetten Gesellschaft m.b.H. (hereinafter “Österreichische Sportwetten”), all of which hereinafter referred to as “we” or “us”, are pleased that you are visiting this website.

The Federal Minister of Finance may, by licence, grant the right to conduct games of chance pursuant to Section 14 of the Austrian Federal Gaming Act [German acronym: GSpG] and the right to operate a casino pursuant to Section 21 GSpG.

Casinos Austria holds twelve concessions for casinos in Austria, operating these in Baden, Bregenz, Graz, Innsbruck, Kitzbühel, Kleinwalsertal, Linz, Salzburg, Seefeld, Velden, Vienna and Zell am See. Österreichische Lotterien has a licence to operate certain lotteries, such as Lotto, Toto, instant lotteries, class lotteries, Zahlenlotto, electronic lotteries (online gaming [“win2day”]) and draws via video lottery terminals [“VLT locations of WINWIN”], bingo and keno, together with additional games involving multi-stage draws.

Österreichische Sportwetten offers betting, in particular sports betting, based on authorisations issued under the respective provincial legislation on bookmakers and totalisers.

The current version of the Federal Gaming Act and the provincial legislation on bookmakers and totalisers can be accessed and viewed via the federal legal information system www.ris.bka.gv.at/defaultEn.aspx.

Fundamentals of our Privacy Policy

This Privacy Policy explains which personal data we process on our websites and apps, and how and for what purposes we do this in the course of providing the services we offer, based on the licences and authorisations granted to us. We also inform you about your rights as a data subject.

We would ask that you read this Privacy Policy carefully. By using our products and services that result in the processing of your personal data by us, you confirm that you have been informed about the use of your personal data in accordance with this Privacy Policy.

The protection of your personal data is a high priority for us. If you do not wish your personal data to be processed within the scope of this Privacy Policy, we would ask that you not provide us with your personal data. In that case, you will not have access to or be able to use those services and products for which the processing of your personal data is necessary (e.g. customer loyalty programmes, discount campaigns or event offers tailored to you).

Your contact for data processing is our Data Protection Officer

E-mail address: datenschutz@cal.at

Data Controllers and Processors

The following companies (also referred to jointly as our “Corporate Group”) act as data controllers or, where applicable, as processors in connection with our services and products, in accordance with the provisions of data protection law:

Casinos Austria Aktiengesellschaft

FN 99639d

Österreichische Lotterien Gesellschaft m.b.H.

FN 54472g

Glücks- und Unterhaltungsspiel Betriebsges.m.b.H.

FN 241637z

Casinos Austria International Holding GmbH

FN 37681p

Österreichische Sportwetten Gesellschaft m.b.H.

FN 196645i

Cuisino Ges.m.b.H.

FN 54015i

CAST Casinos Austria Sicherheitstechnologie GmbH

FN 94404f

Österreichische Klassenlotterie Vertriebsgesellschaft m.b.H.

FN 468412t

The registered office of all of these companies is located at:

Rennweg 44

1038 Vienna

Congress Center Baden Betriebsgesellschaft m.b.H.

FN 67046y

Kaiser Franz Ring 1

2500 Baden

Processors are engaged by us to process your data for us within the scope of what is provided by law. This applies both to data processing by the above-referenced companies within our Corporate Group and to data processing by processors outside our Corporate Group.

We only use processors outside the European Union if (i) an adequacy decision has been issued by the European Commission for the third country in question or (ii) we refer to the standard contractual clauses of the European Commission or (iii) if suitable guarantees are in place with the third country or (iv) we have agreed on binding internal data protection rules with the processor.

Based on our organisational structure as a Corporate Group, individual companies from our Corporate Group may act as contract data processors to process data on our behalf. A data processing contract has been concluded for that purpose.

Apart from transfers to other companies within our Corporate Group, your data will only be transferred to third parties if you have previously expressly consented to the transfer of your data, if we are legally obliged to do so, if the transfer of data is necessary for the performance of our contract with you, or if there are sufficient legitimate interests present. Your personal data will not be sold to third parties or marketed in any other way.

Facebook fan page

When a Facebook fan page is operated, there are joint data controllers processing the data, meaning that the data is processed by the Group company operating the Facebook fan page in question and Facebook.

Information on the data processing that takes place in the course of operating a Facebook fan page can be found here. Via that information page, you may also review the corresponding data processing contract.

Recipients

Data may be transferred to the following recipients (groups of recipients), for example as part of performing contracts, complying with legal obligations or pursuing legitimate interests. These are data controllers or processors. Further information on recipients can be found in the chapter Data controllers and processors and in the following chapters.

• Legal representatives
• Courts and other authorities
• Banks
• Credit reference agencies
• Acceptance points and payout points
• other contractual and business partners

Personal Data

Personal data is any information relating to an identified or identifiable natural person. In the section below, we provide you with examples of personal data that we collect and process in connection with your use of our products and services, provided there is a legal basis for doing so:

• Name and surname,
• Salutation,
• Date of birth,
• Citizenship,
• Contact address(es) (e.g. e-mail address),
• Telephone number, fax number,
• Company data,
• User administration data (e.g. account data, username, password),
• Employer,
• ID data from official photo IDs (e.g. ID card number, passport number, driving licence number, personal master data, ID scan),
• Credit card number and data, bank details,
• Cookies, IP addresses,
• Location data,
• Data on your visits and gaming,
• Interests (e.g. games, events, hobbies, leisure, sports, cultural and culinary preferences),
• Income and/or financial circumstances, credit ratings and insolvency data.

Note: Not all of the examples shown here are processed by all companies in the Corporate Group.

Collection and processing of personal data

We only collect and process personal data to the extent permitted by law. This will be the case, for example, if you have given your consent to the processing of your personal data for one or more specific purposes. The processing of your personal data may also be necessary for the performance of a contract or for compliance with a legal obligation to which we are subject.

We process your data, for example, if you have provided it voluntarily, such as when you register for one of our online products, at a casino or at a VLT location, when you order something from the online shop or via our customer service centre, when you take part in a competition or where you contact us in any other way.

We use the personal data provided by you exclusively to the extent that your data is required to achieve the respective purpose (e.g. to perform a contract, to fulfil a legal obligation, to register for one of our online products, to send out newsletters, to process an order in the online shop, to send information materials and advertising, to operate a lottery or other game, to carry out customer analyses, market and opinion research, to answer a question you ask us or to provide access to certain other information).

We collect and process your personal data for products and services of the Corporate Group that you can use independently of each other.

Contract data processing by one or more companies in our Corporate Group occurs, in particular, due to the structuring and organisation of the Group’s business by business lines and holding or competence lines and this is governed by contracts.

Security

We use technical and organisational security measures to protect your data against manipulation, loss, destruction and access by third parties. Our security measures are constantly improved in line with technological developments.

We undergo annual certification in accordance with the GoodPriv@cy international data protection seal of approval, which verifies our strict data protection policy and supports us in continuously improving it.

All information we receive from you, such as your name, address, telephone number, e-mail address, account information or credit card number, is transmitted and protected between your browser and our central server using SSL (Secure Socket Layer). The security server software encrypts all the information you enter before it is transmitted to us. The information is only decrypted once it reaches our server. This prevents unauthorised persons from reading, changing, interpreting or copying this information during data transmission and resending it later.

Game Secrecy

In addition to the general data protection regulations, our Corporate Group is subject in particular to the provisions of Section 51 of the Austrian Federal Gaming Act (GSpG), which deals with game secrecy. This provision stipulates that promoters of games of chance that are subject to the gambling monopoly, their board members, employees, contractual counterparties and other persons working for the promoters must preserve confidentiality about the players and their participation in the game (win or loss) (game secrecy). Exceptions to game secrecy are conclusively governed by this statute, and relate, for example, to duties to provide information to authorities and courts or to circumstances where the player has given an express release from game secrecy. As the safeguarding of game secrecy is a prerequisite for maintaining the right to operate games of chance, the strictest confidentiality is maintained with regard to your participation in the game and your winnings or losses.

Player Protection

Based on the provisions of the Federal Gaming Act, we are obliged in certain cases to record your visiting behaviour and to observe your gambling behaviour and, if necessary, to initiate measures for your own protection.

You can find more information on player protection and responsible gambling at www.playsponsible.at.

Credit reports

In certain cases regulated by law, Casinos Austria, Österreichische Lotterien and WINWIN are obliged to check your creditworthiness on the basis of documents, data or information obtained from a credible and independent source. By carrying out a credit check, we are complying with our legal obligations; in addition, the credit check serves to protect players and is thus in the interests of your own security.

To carry out the credit check, we transmit the required personal data (such as name, address and date of birth) to the following credit agencies:

Dun & Bradstreet Austria GmbH

Jakov-Lind-Strasse 4/1,

1020 Vienna

https://www.dnb.com/de-at/datenschutz.html

CRIF GmbH

Rothschildplatz 3/Top 3.06.B,

1020 Vienna

https://www.crif.at/datenschutz

Kreditschutzverband 1870

Wagenseilgasse 7

1120 Vienna

https://www.ksv.at/datenschutzerklaerung

These credit agencies use the personal data transmitted by us to carry out a corresponding assessment of your creditworthiness (scoring) on the basis of mathematical-statistical processes.

In light of our legal mandate, we have both an obligation and a legitimate interest in obtaining information on insolvencies (private and corporate insolvencies) in order to be able to take the necessary measures to protect players. For this reason, we are provided with information on insolvencies (personal and corporate insolvencies) via an insolvency database, on the basis of a contract with Kreditschutzverband 1870. These credit agencies process the transmitted personal data as independent controllers for their own purposes as credit agencies and address publishers, as described in their respective privacy notices.

Anti-money laundering

Based on the provisions of the Austrian Financial Markets Anti-Money Laundering Act (FM-GwG) and the Austrian Federal Gaming Act (GSpG) as well as in accordance with provincial betting laws, we are obliged throughout the entire Corporate Group to identify and verify your personal data if you register as a player to use our online products, visit a Casinos Austria casino or a VLT location or have a win equal to or exceeding a certain amount. Furthermore, we are obliged to obtain and verify information about contractual relationships, the origin of the funds used and about players’ income and asset situation, as well as to continuously monitor the business relationship and the transactions carried out in connection with it. In particular, we must retain copies of the documents and information we have received that are necessary for the fulfilment of the due diligence obligations described and the transaction documents and records that are necessary in order to investigate transactions.

The Financial Markets Anti-Money Laundering Act (FM-GwG) grants us the legal authorisation within the meaning of the GDPR to use the above-referenced data of our customers in the context of our own due diligence to prevent money laundering and terrorist financing, which we are legally obliged to do and which serve the public interest. Data processing within the scope of the due diligence obligations described here is based on a legal obligation.

In accordance with Secs. 24 (6) in conjunction with Sec. 2 (11) FM-GwG, we are obliged to disclose the information submitted in connection with a suspicious activity report within our Corporate Group. Furthermore, we exchange personal data in individual cases for the purposes of combating money laundering and terrorist financing within our Corporate Group in accordance with section 24 (6) FM-GwG, in particular to the extent necessary to fulfil our due diligence obligations in order to operate the strategies and procedures applicable throughout the group in accordance with section 24 (1) FM-GwG.

Whistleblower System

Via https://www.bkms-system.net/cal, our Corporate Group provides you with the ability to report irregularities and address grievances within the Group to the top management via a whistleblowing system. As a Corporate Group, we have an overriding legitimate interest in learning of such irregularities and grievances. Communications between you and us are made possible through submitting, receiving, processing and responding to anonymous or, at the reporter’s option, non-anonymous reporting, by means of an app service provider via a specially secured server. Business Keeper AG (BKAG) has developed this whistleblower system and works for us within the scope of the data protection regulations. BKAG has no access whatsoever to the content of the reports that are communicated through the whistleblower system. The data and reports entered by whistleblowers are only stored for as long as is necessary for the final processing of the reports. If you have not provided any personal data as a whistleblower, the whistleblower system will safeguard your anonymity through appropriate technical and organisational measures. This means that the whistleblower can submit information without having to provide any personal details, but at the same time it is optionally possible to submit information on a non-anonymous basis, so that a personal reference can be made.

Video surveillance of building exteriors

Buildings in which we operate for the provision of services and on which corresponding notices are displayed are externally monitored by video surveillance. This serves the purpose of protecting persons, such as our employees, our property, other items and assets owned by the company, as well as the purpose of supporting and securing work processes, such as the handling of deliveries and activities in and around the monitored building. As a basic principle, the legal basis for this is the legitimate interest in protecting persons, property and rights. In individual cases, however, the legality of video surveillance may also arise from consent, or such surveillance may be necessary for the performance of a contract or a legal obligation. These legal bases may also result in the transfer of data to third parties, such as courts, authorities, insurance companies or victims of criminal offences, on a case-by-case basis. As a general principle, the retention period for video recordings is 72 hours. However, the need for a longer retention period may arise in individual cases, for example due to the impairment of our legitimate interests and the enforcement of related legal claims.

Video surveillance in our casinos and at VLT locations

In order to comply with legal regulations and for your own protection, gaming operations at Casinos Austria casinos and VLT locations of Österreichische Lotterien are monitored by video in accordance with data protection regulations. The retention period for video recordings of building interiors is 10 days.

Use of our websites and applications

Use of our websites (in particular casinos.at, shop.casinos.at, casinosaustriainternational.com, lotterien.at, win2day.at, tipp3.at, oeswe.at, winwin.at, playsponsible.at, ccb.at) as well as of our apps (in particular win2day: lotto, casino, betting; Lotteries Shaker; win2day Poker; Lotteries App; tipp3; tipp3 Trafik) is generally possible without providing personal data. However, use of individual services may be subject to different rules, which we will point out separately.

When you visit our websites, information such as your IP address is transmitted to us. For example, this information provides information about the end device used (computer, smartphone, tablet, etc.), the browser used (Firefox, Chrome, Safari, Edge, etc.), the time of access to our websites and the volumes of data transferred. This information may be processed for system security reasons (to protect against misuse), to ascertain the attractiveness of our websites or to continuously improve their content for you.

When downloading apps, users must authenticate themselves in the App Store (e.g. Apple App Store, Google Play Store) with the necessary information. We have no control over, nor are we responsible, for the data collected in the course of the download, in particular the e-mail address and customer number of your store account or the device identification number of your end device. We only process the device information from such data provided to us to the extent necessary to download our apps to your device. Beyond this, we will not undertake any further processing of the data.

You can also find further information under Data processing when you use our apps.

Links to other websites

Our websites contain links to other websites. Compliance with the relevant data protection provisions for these websites is the responsibility of the operators of the respective websites and is therefore beyond our control. We are therefore not responsible for the data protection practices or the content of those other websites.

Mailings

Consent pursuant to Sec. 174 (1) Austrian Telecommunications Act 2021 [TKG 2021] in conjunction with Art 6 (1)(a) GDPR

Within our Corporate Group, you have the option of subscribing to various forms of newsletters and/or mailings.

Depending on the scope of the consent you have provided, and the processing purpose covered by it, various details of your personal data, specifically your name, title, date of birth, nationality, residential address, telephone number, fax number, user administration data, e-mail address, visit and game data, information on your interests (e.g. range of games, events, hobbies, leisure, sport, cultural and culinary preferences, use of promotions) may be processed for advertising purposes, if you have provided this information.

You will find out which personal data is processed for which purpose in connection with the specific occasion of your contact with us when you submit your declaration of consent. If you have consented to receiving information and mailings, then depending on the scope of your declaration of consent, you will, for example, receive current news and information about promotions and offers as well as services and competitions of the respective company of our Corporate Group.

Your e-mail address, postal address and telephone number will be used for mailings and information if you have identified these channels for communications with us. You can also receive information and mailings in the form of push notifications via our websites and apps.

You can find more information on the possibility of withdrawing your consent in the section Right to withdraw consent.

In this context, your data will only be passed on to processors or third parties to the extent that this is necessary to carry out mailings.

Legitimate interest pursuant to Section 174 (4) TKG 2021 in conjunction with Art 6 (1) (f) GDPR

If we receive your e-mail address in connection with a sale or a service (e.g. when you register as part of a casino visit or as part of your participation in an advantage club or when you create a user account on win2day), the Group company in question may send you direct advertising in the form of information and mailings for its own or similar products and services by e-mail (including text message) on the basis of the existing customer relationship and on the basis of legitimate interest. You can object to this processing when your contact details are being requested (opting-out) or each time an email or a text message is sent to you by clicking unsubscribe (“unsubscribe/de-register”), and you may also object by sending a message to datenschutz@cal.at at any time.

Legitimate interest in information in socio-politically relevant areas

Casinos Austria and its processors process your personal data, such as title, name, home address and/or e-mail address, which you have provided to us or which is publicly accessible, in order to send you information and invitations to art and culture-related events. These mailings are made on the basis of and for the purpose of the Group’s legitimate interest in promoting art and culture as areas of socio-political relevance.

Casinos Austria and its processors process personal data, such as your title, name, home address and/or e-mail address, which you have provided to us or which is publicly accessible, in order to send you up-to-date information about Casinos Austria in the form of a newsletter. These mailings are made on the basis and for the purpose of the Group’s legitimate interest in passing on information about developments and events in the gambling sector, as a socially relevant area, to parties who are interested in them or to whom the information is relevant.

Photography and filming at events and TV shows

It is possible that photographs and/or video recordings of you may be taken and stored in Casinos Austria casinos, at WINWIN VLT locations as part of events or during Austrian Lotteries shows.

If you have given your consent, these photos and recordings may be processed by the companies named therein and for the purposes and to the extent specified in the consent given in each case.

Such publication does not give rise to any claims whatsoever.

You can find more information on the possibility of withdrawing your consent in the section Right to withdraw consent.

Competitions and non-cash prize lotteries

When you participate in competitions or non-cash prize lotteries, we process your personal data collected for this purpose (as a rule: your name, e-mail address and, if applicable, user name, telephone number, address, etc.) for operating the game or the non-cash prize lottery and/or for performing the contract arising from this, in particular for the prize draw, for prize notifications and for sending prizes. Detailed information can be found in the respective terms of participation.

Only if you have given your express consent may we process the data collected as part of a competition or a non-cash prize lottery for purposes of sending you information, and we may do so only until you withdraw such consent.

Further information on the possibility of withdrawing your consent and objecting to data processing can be found in the sections Right to withdraw consent and Right to object.

Data processing when you use our applications

We only collect, process and use your data on the basis of legitimate interests or your consent and insofar as this is necessary for the proper functioning of the apps or for conducting our own market and opinion research. For this purpose, we use tracking technologies to measure your usage behaviour.

For technical reasons, whenever the apps are used, they automatically transmit certain technical data to our server, including, in particular, features for identification, information on the beginning and end as well as the scope of the use in question and information on the services used by you in each case, for example the date and time of use, the operating system used, the volume of data sent and configuration data. This is necessary for ensuring the functionality of our apps.

Our apps also use a token that is automatically generated when the apps are used for the first time. The token is a small text file that is stored locally on the app – similar to a cookie – and contains only a randomly generated identification number. The token serves as an identification feature and enables our system to recognise that you have installed the app, so that the required content can be delivered to the app (e.g. push notifications if consent for this has been given). The token is stored on our servers and in a separate area of the apps to which only the app has access. The token is erased after four years of inactivity, which means that our servers can no longer recognise that the app is installed on your device.

Digital Services (Facebook, Conversational Interfaces, etc.)

To use some of the Group’s offers and services, you need an account with the social network Facebook, 1601 South California Avenue, Palo Alto, CA 94304, USA or with Amazon Media EU S.à r.l. (Société à responsabilité limitée), 5 Rue Plaetis, L-2338 Luxembourg. When you visit Facebook pages or use an Alexa device, a direct connection is established between your end device and the Facebook server or the Amazon server. Facebook and Amazon receive the information that you have accessed our Facebook page with your IP address or have accessed the lottery skill on Amazon’s Alexa device. We would like to point out that we have no knowledge of the content of the transmitted data or its use by Facebook or Amazon. Further information on this can be found in the Facebook Privacy Policy and/or in the Amazon Privacy Policy.

The content on external channels is created and expanded with the utmost care. However, the extent to which it is up-to-date and correct is influenced by technical factors such as the Internet connection or whether the most current operating system is being used, and thus cannot be guaranteed.

Recording of telephone conversations in individual cases

In individual cases and only after our employees have informed you of this, insofar as legally relevant statements are made over the phone, we may record the telephone conversations to protect our guests, our employees and our company. The conversations are processed by us for the duration of an assessment of their criminal relevance, transmitted to the competent authorities if they are found to be such and then stored for as long as necessary, and are otherwise erased. Records are exempt from erasure as long as they are required for the enforcement or defence of legal claims before authorities or courts. Data processing is based on our overriding legitimate interest, in accordance with Section 4 (3) (2) 2nd case Data Protection Act [DSG] in conjunction with Art. 6 (1)(f) GDPR, in reporting legally relevant facts against our employees and our company.

Data processing for statistical purposes

For statistical purposes (improvement of our range of services, to verify the effectiveness or success of advertising measures, to check the functionality of our product and service offerings) and for performing risk analyses (in particular to combat fraud), the personal data lawfully collected by us, in particular the master data, game and visit data, is processed in anonymised form. These statistical analyses only contain aggregated or anonymous information without any personal reference. The associated data processing is based on our overriding legitimate interest (Art. 6 (1) (f) GDPR) in being able to offer our customers the best possible services.

Casinos Austria

Visit to a casino

When you visit a Casinos Austria casino, you are legally obliged to present official photo ID in order to establish and verify your identity and age and to fulfil legal due diligence obligations. For this purpose, the data on your official photo ID will be stored in the Casinos Austria customer database on your first visit and recorded, compared and verified on each subsequent visit, or data on other IDs will be stored if you visit our casinos with different official photo IDs. Casinos Austria processes your name, title, date of birth, nationality and ID data (type, ID number, master data, scan). In addition, every time you visit the casino, a current photo is taken of you for the purpose of verifying your identity, and stored in the customer database. Your visit and game data are also recorded and processed in accordance with legal requirements.

Glücks Card bonus programme

Upon issuance of the “Glücks Card”, you have the opportunity to participate in Casinos Austria’s bonus programme. For the purpose of operating the “Glücks Card” bonus programme as well as for customer support and active player protection, Casinos Austria processes your personal data – if available and/or disclosed – such as e-mail address(es), name, date of birth, citizenship, address(es), telephone number(s), interests (culinary, events, range of games), company, purchasing behaviour in the online shop, use of promotions/consumption, participation in draws and competitions as well as your visit and gaming data in the casino operations.

As part of the “Glücks Card” bonus programme and for information about our product and service offerings, Casinos Austria uses analysis software on the basis of your consent in order to be able to send and provide you with personalised and customised direct advertising.

You can find more information under Mailings and Analysis software. You can find the respective benefits and terms of participation at casinos.at. Further information on the possibility of withdrawing your consent and objecting to data processing can be found in the sections Right to withdraw consent and Right to object.

Casinos Austria apps

The casinos.at website and the online shop portal shop.casinos.at are software apps of Casinos Austria and are hereinafter referred to as “apps”. As a non-registered user, you can use the Casinos Austria apps to obtain general information (e.g. opening hours, casinos, events) and offerings (e.g. information on competitions and offers) from Casinos Austria. It is also possible to place orders in the online shop without registering.

When you register on the apps, you transmit your e-mail address and your user administration data (password, user name = e-mail address) to Casinos Austria for processing. To protect the e-mail address, processing is carried out using IdentityID.

Once you have registered, you will be able to use your My Casino account and the online shop and take part in competitions.

My Casino account:

You will have the opportunity to have your My Casino account linked by Casinos Austria when you next visit the casino by presenting your official photo ID. Your My Casino account will then be linked to your personal data from the “Glücks Card” bonus programme – if available and/or disclosed – such as e-mail address(es), name, date of birth, citizenship, address(es), telephone number(s), interests (cuisine, events, range of games), company, purchasing behaviour in the online shop, use of promotions/consumptions, participation in prize draws and competitions as well as your visit and gaming data in the casino establishments. By linking your My Casino account to the “Glücks Card” bonus programme, Casinos Austria will process all the personal data listed, provided that you have disclosed them and have not withdrawn your consent. Casinos Austria uses analysis software so that we are able to show you personalised and customised content. If you link your My Casino account, you must agree to the terms and conditions of the “Glücks Card” bonus programme. Data processing is carried out in accordance with the Privacy Policy set out in the terms of participation and in accordance with this Privacy Policy.

If you have given your consent, you will also receive mailings and information as part of the “Glücks Card” bonus programme.

You can find more information about the apps and the “Glücks Card” bonus programme from Casinos Austria at Glücks Card Programme, Mailings, Data processing when you use our apps and Analysis software.

You can find more information on the possibility of withdrawing your consent in the section Right to withdraw consent.

Online shop:

The Casinos Austria online shop offers you the opportunity to purchase the products available at shop.casinos.at online. When processing your order, Casinos Austria processes the following personal data: your name, title, date of birth, e-mail address, home address and your purchasing behaviour and purchases. Optionally, you can also send your title, your telephone number and your company and VAT number to Casinos Austria. If you have given your consent, you will receive information and mailings as a shop customer to the extent of the consent you have provided. If you have given your consent, your orders will be analysed in order to provide you with personalised information about offers in the online shop. You can find more information on this under Analysis software and Mailings.

You can find more information on the possibility of withdrawing your consent in the section Right to withdraw consent.

Payment by credit card:

When you select payment by credit card, you will be redirected to the payment service provider’s website. For secure payment processing, an anonymised transaction ID, details of the financing and payment terms (e.g. price, VAT rate) and traffic data (e.g. IP address, browser data) are sent to the external payment service provider Unzer Austria GmbH (Grüngasse 16, 1050 Vienna, Data protection - Unzer). We do not store any of your payment data ourselves.

Payment by instant bank transfer:

When you select payment by instant bank transfer, you will be redirected to the payment service provider’s website. For the secure execution of payment processing, an anonymised transaction ID, information on the financing and payment terms (e.g. price, VAT rate) and traffic data (e.g. IP address, browser data) are sent to the external payment service provider Sofort GmbH/Klarna AB (Klarna Bank AB (publ). Sveavägen 46, 111 34 Stockholm, www.klarna.com/de/datenschutz/). We do not store any of your payment data ourselves.

Casino information and mailings

Based on your consent, you will receive personalised mailings and information from Casinos Austria by e-mail, text message, post and telephone. The mailings and information contain general and personalised news tailored to your individual interests about promotions and offers (e.g. entry price reductions, vouchers, catering services, events, highlights from the world of lotteries), the range of games and betting offerings (e.g. poker tournaments, casino tournaments), about services (e.g. information on player protection, customer surveys and benefits under the “Glücks Card” bonus programme), shop promotions in the Casinos Austria Online Shop (e.g. for the purchase of vouchers, special offers and discount promotions), prize draws and current competitions run by the Casinos Austria AG & Österreichische Lotterien GmbH Corporate Group (Casinos Austria AG, Österreichische Lotterien Gesellschaft m.b.H., Glücks- und Unterhaltungsspiel Betriebsges.m.b.H., Österreichische Sportwetten Gesellschaft m.b.H., Casinos Austria International Holding GmbH, Cuisino Ges.m.b.H. and Congress Center Baden Betriebsgesellschaft m.b.H.). Furthermore, Casinos Austria, or market and opinion research institutes (such as IMAS International) engaged by us which act as processors for us, may carry out customer surveys within the scope of your consent.

As part of the “Glücks Card” bonus programme, you will receive mailings and information as well as benefits from cooperation partners, insofar as these are offered as part of the "Glücks Card" bonus programme, on the basis of your consent or on the basis of Casinos Austria's legitimate interest in sending direct advertising to guests. Customer surveys are conducted on the basis of your consent.

You can also receive information on mailings via the apps and at the reception desks or other points of contact at Casinos Austria’s casino locations.

Your personal data, which you disclose to Casinos Austria in connection with events, tournaments and competitions, will be used for personalised mailings or the exchange of information, provided you have given your consent.

As part of the casino information and mailings, Casinos Austria uses analysis software to send and provide you with personalised and customised direct advertising. You can find more information at Mailings and Analysis software.

You can find more information on the possibility of withdrawing your consent in the section Right to withdraw consent.

Feedback service

Via the feedback button on www.casinos.at you have the opportunity to direct specific feedback regarding an element of this website, general feedback on the website or a specific request or question to Casinos Austria. The Casinos Austria Service Centre is available to answer your questions via e-mail (service@casinos.at) for you. You can also use the feedback service set up on the website. If you provide these, the following personal data will be processed by Casinos Austria on the basis of your consent: Your title, your name, your e-mail address, your home address and your nationality.

You can find more information on the possibility of withdrawing your consent in the section Right to withdraw consent.

Cuisino Restaurant Reservations

The service ‘quandoo’ enables you to book a table in a Cuisino restaurant by providing your personal data, such as name, e-mail address and telephone number. You can also make your reservation by telephone or e-mail. Cuisino processes the data you provide for the purpose of processing your reservation.

Personalised guest service

If you have given your consent, Casinos Austria will record your date of birth, your interests and hobbies as well as your preferences as to items you consume in the casino establishments (e.g. food and drinks) in order to be able to respond to individual guest wishes and expectations in the best possible manner.

You can find more information on the possibility of withdrawing your consent in the section Right to withdraw consent.

Handling of reservations

On the Casinos Austria website (casinos.at) you can make reservations for individual and group visits to your chosen casino. In order to process your reservation, Casinos Austria processes your name, title, e-mail address, telephone number, address, date of birth and, optionally, your company and order number.

Event management and marketing apps

Casinos Austria uses an event management and marketing app for the purpose of organising and running events for companies and private individuals and creating accompanying work plans and reports. Casinos Austria uses this system to process your personal data, specifically your name, your telephone number, optionally your e-mail address and address and, if available, data on your food and drink orders, for the purpose of preparing offers and invoices on the basis of the event agreement. Casinos Austria also processes this data to perform the organisation of events (e.g. to issue work orders to property management, technical services, reception and catering). This makes it possible to coordinate work tasks for the events, promotions and functions that take place every day at the gaming facilities.

Casinos Austria processes contact data of B2B customers (companies and associations) for the purpose of acquisition and sales activities in the business-to-business sector (B2B) in respect of its offerings of goods and services. B2B customers receive personalised information and mailings from Casinos Austria within the scope of the consent given. More information can be found at Analysis software and Mailings.

You can find more information on the possibility of withdrawing your consent in the section Right to withdraw consent.

Opening a “Depot” cash reserve account and submitting drawdown requests

Casinos Austria offers you the opportunity to open a cash reserve or “Depot” account. When opening your Depot account and processing your requests, Casinos Austria processes your personal data, specifically your name, date of birth, e-mail address, home address, telephone number and bank details (bank name and address, IBAN, BIC/SWIFT and the amount requested) and transaction data. This processing is undertaken as part of our performance of the contract and on the basis of our legitimate interest in resolving any questions with you in connection with your customer account (Art. 6 (1)(b) and (f) GDPR).

Österreichische Lotterien

Lotteries information and mailings (Glückspost, Bingo News)

Within the scope of your declaration of consent, you will receive mailings and information from Austrian Lotteries by e-mail. Austrian Lotteries uses analysis software to send you personalised and individually tailored direct advertising. More information can be found at Mailings and Analysis software.

You can find more information on the possibility of withdrawing your consent in the section Right to withdraw consent.

Lotteries Shaker App

With the Lotteries Shaker app, you can place Lotto, LottoPlus, Joker and EuroMillions bets and play scratch-off and break-open tickets (“Brieflos”). You need a win2day account to place a bet and play a scratch-off ticket or Brieflos. You can find out which data is processed here win2day Account. You can find more information about the app at Data processing when you use our apps.

Lotteries app

The Lotteries App is a service app for the products played at the lottery retailer. For Lotto, LottoPlus, Joker and EuroMillions, bets can be placed via the Lotteries app by topping up a credit balance at Austrian Lotteries retail outlets. This app works without registration. More information at Data processing when you use our apps.

Österreichische Klassenlotterie Vertriebsgesellschaft m.b.H.

Österreichische Klassenlotterie Vertriebsgesellschaft m.b.H. processes the following personal data on the basis of your declaration of consent: Your name, your address, your telephone, fax and mobile phone number, your e-mail address, your date of birth and your bank details.

As a customer, you will receive an information letter by post before the start of the lottery due to the legitimate interest of Österreichische Klassenlotterie in sending information to its customers. No further advertising mailings will be sent.

You have the option to withdraw from receiving the newsletter at any time in the future by e-mail to office@klassenlotterie.at or by post to Österreichische Klassenlotterie Vertriebsgesellschaft m.b.H., Rennweg 44, 1038 Vienna.

Partners in the Association of Class Lottery Offices [Verband der Geschäftsstellen der Klassenlotterie]:

GST 23 HOHE BRÜCKE GmbH, 1013 Vienna, Wipplinger Strasse 21

GST 28 J. Prokopp Ges.m.b.H., 1061 Vienna, Mariahilfer Strasse 29

GST 33 GKL HOHE BRÜCKE GmbH, 1010 Vienna, Wipplinger Strasse 21

GST 61 Franziska Hrubesch, 3502 Krems, Lerchenfelder Hauptplatz 10

GST 72 Oberbank AG, 4020 Linz, Untere Donaulände 28

GST 82 Paul Fochler Klassenlotterie GmbH, 8010 Graz, Tummelplatz 6

GST 88 Klassenlotterie Prokopp Int. GmbH, 1060 Vienna, Mariahilfer Strasse 29

As a basic principle, no personal data is exchanged between Österreichische Klassenlotterie Vertriebsgesellschaft m.b.H and the partners in the Association of Class Lottery Offices.

Further information on the possibility of withdrawing your consent and objecting to data processing can be found in the sections Right to withdraw consent and Right to object.

win2day

win2day account

To be able to use the online offer from win2day, you must register at www.win2day.at or register on our apps. When you do so, you provide your e-mail address, your title, your name and your date of birth. As part of the registration process, your name, date of birth and place of residence will be compared with the CRIF GmbH database in order to comply with the provisions of the Gaming Terms and Conditions and Betting Rules.

The following data processing also takes place in connection with your win2day account:

Fulfilment of legal obligations in the area of player protection (Federal Gaming Act [GSpG]) as well as the Financial Markets Anti-Money Laundering Act [FM-GwG], Federal Tax Code [BAO] and Commercial Code [UGB]

The legal requirements for player protection oblige us to ensure your identity in the following cases:

• if you change your deposit limit to over €400 or
• if your deposit amount is €400 or, if you are not yet 26, €250, or
• when the first payment is made. This also requires you to disclose your bank details.

Identification can be performed using the photo-identification procedure. Your photo and photo ID data will be processed. When identifying yourself by using the mobile phone to provide an electronic signature/to use ID-Austria and online banking, your name and date of birth will be stored until the identity check has been completed.

The information regarding your identity as well as the transaction documents and records (specifically: login and game data) will be stored for the legally prescribed period in order to fulfil the legal obligations as defined by the FM-GwG, BAO, UGB.

Change of the weekly deposit limit on win2day

The following personal data is processed in connection with a desired setting of the weekly deposit limit:

• Information about your usage behaviour and the associated analyses to identify problematic gaming behaviour,
• information provided by you for the supplementary assessment of your usage behaviour and
• information about your financial situation (creditworthiness; e.g. income and assets). In this context, information is also obtained from independent organisations that provide credit information (e.g. CRIF GmbH).

We process this personal data to assess whether there are reasons militating against your desired limit setting (e.g. lack of creditworthiness), and we also do this for your protection in order to counteract potentially problematic developments in your gaming activity. In addition, the information on your income and financial circumstances is also processed for the fulfilment of the statutory due diligence obligations for the prevention of money laundering and terrorist financing in accordance with the Financial Markets Anti-Money Laundering Act [FM-GwG].

Data processing is carried out on the basis of Art. 6 (1)(b) GDPR (performance of the contract) and Art. 6 (1)(c) GDPR (fulfilment of legal requirements in the area of player protection in accordance with the Gaming Act and the FM-GwG).

Player protection measures

As part of the use of the win2day online offer, a prevention tool (MENTOR) is used for purposes of evaluating your gaming behaviour (in particular gaming and usage data). This tool is made available to you free of charge, and provides you with information and useful tips for your own responsible gaming. The tool is operated by our contractor neccton GmbH, Davidgasse 5, A-7052 Muellendorf. In addition, internal analysis tools are used to identify problematic gaming behaviour in order to further increase the level of protection. For this purpose, information about your gaming, stakes, creditworthiness data as well as breaks from gaming and suspensions are analysed and values (“scores”) are calculated. In addition, the tools undertake a comparison with the public edicts archive at regular intervals, and obtain information from independent organisations that provide creditworthiness information (e.g. CRIF GmbH), in order to ensure a sufficient credit rating. These queries and evaluations enable us to take appropriate measures to protect players, particularly in the event of conspicuous gaming or payment behaviour. The calculated values only serve as an indicator and are included in the overall assessment for detection of problematic gaming behaviour, which our employees carry out in justified cases. However, under no circumstances are measures taken automatically when certain values are reached without an employee having examined the specific individual case.

The processing in this regard is carried out on the basis of Art. 6 (1)(b) GDPR (performance of the contract), Art. 6 (1)(c) GDPR (fulfilment of legal obligations) and Art. 6 (1)(f) GDPR (protection of overriding legitimate interests of the controller). Our overriding legitimate interest is to implement the legal requirements in the area of player protection and to be able to demonstrate their full implementation. If special categories of personal data are processed, the relevant processing is carried out on the basis of Article 9(2)(c) GDPR.

Customer support for win2day customers

As part of personal customer care, information you provide about your personal interests or preferences (e.g. favourite sports club, culinary preferences), your personal master data (in particular name, address and contact details) and your usage behaviour on the win2day platform will be used to provide you with personalised support (e.g. event invitations) by means of electronic mailings (e.g. by e-mail, text message, push, web push, messenger services or similar technologies), by telephone or by post. Such support will only be provided if you have given us your express consent to do so (Art. 6 (1) (a) GDPR).

You can find more information on the possibility of withdrawing your consent in the section Right to withdraw consent.

win2day information and mailings

On the basis of your express consent, win2day will send you personalised electronic mailings (e.g. by e-mail, text message, push, web push, messenger services or similar technologies) and postal mailings containing information about promotions and offers (e.g. free game or betting credits, highlights from the world of lotteries), the range of games, services (e.g. customer surveys), advertising, prize draws and current competitions. As part of its mailings, win2day uses analysis software to send you individual and personalised information and offers. More information can be found at Mailings, Analysis software and Right to object. You can find more information on the possibility of withdrawing your consent in the section Right to withdraw consent.

Publication of rankings and nicknames

We do not publish the names of winners or participants. In the context of tournaments, ranking lists and certain game offerings, we therefore only publish the nicknames of winners and participants on win2day.at in order to ensure anonymity and to ensure transparency about the distribution of prize winnings, and to enable the game to be carried out. We also provide you with our nickname generator, which allows you to change your nickname easily. As a rule, nicknames are also anonymised by replacing the nickname with five asterisks from the fourth character onwards. In this case, the processing is based on our legitimate interest pursuant to Art. 6 (1)(f) GDPR to transparently demonstrate the actual distribution of prize winnings.

Slot tournaments, live casino, game shows, poker, bingo, kick-tip and sports tournaments would not be possible without publishing the full nicknames of the participants, which is why such anonymisation does not take place in such cases. Therefore, please do not use nicknames by which you could potentially be uniquely identified. Details can be found in the applicable terms of participation. Processing in this regard is carried out on the basis of Art. 6 (1)(b) GDPR (performance of the contract).

Personalisation of content on win2day.at

We process the following personal data concerning you for the purpose of offering you the most customised product range possible on our win2day platform:

• personal master data (e.g. name, date of birth, e-mail address, nickname)
• information about your usage behaviour on the win2day platform
• technical traffic data (e.g. information on the end device used, operating system, browser, technical log files)
• reactions to advertising measures

This personal data is used to

• analyse your preferences and habits,
• anticipate your interests based on our analysis of your profile and make it easier for you to navigate our platform (in particular by displaying games that you play particularly frequently or game recommendations that are of interest to you) and
• to provide you with a customised user experience on our win2day platform (in particular by displaying product and service offerings and information).

This data processing for the purpose of personalising the platform content is undertaken exclusively on the basis of your express consent. This type of data processing constitutes profiling in accordance with Art. 4(4) GDPR (see section on Profiling).

You can find more information on the possibility of withdrawing your consent in the section Right to withdraw consent.

win2day: Lotto, Casino, Betting App

With win2day: Lotto, Casino, Betting app, you can participate in all casino and lottery games as well as sports betting on a single app. You need a win2day account to participate in the game. win2day processes the data you provide during registration. More information at Data processing when you use our apps and under win2day Account.

Real money poker casino: win2day

With the Real Money Poker Casino: win2day app, you can play online poker for real money on an app. You need a win2day account to participate in the game. win2day processes the data you provide during registration. More information at Data processing when you use our apps and under win2day Account.

win2day Sports: Sports betting app

With the win2day Sports: Sports betting app, you can use real money to bet on sports on an app. To participate, you need a win2day account. win2day processes the data that you submit during your registration. More information at Data processing when you use our apps and under win2day Account.

WINWIN

VLT site visit with the WINWIN Card

Visiting a VLT location is only possible after you have registered at a VLT location, and only with an active WINWIN Card. The obligation to register and to present an official photo ID in connection with this arises from the provisions of applicable law. Your identity is established and verified by means of your official photo ID. For this purpose, the data on your official photo ID is stored during your first visit and compared and checked upon each subsequent visit. For the purpose of customer registration, WINWIN processes your name, address, ID card number, ID card type, biometric data (photo), and optionally your title, mobile phone number and e-mail address. WINWIN also processes your visit and gaming data, visit frequency, length of stay and net gaming time, which are collected using the WINWIN Card at WINWIN locations for the purpose of complying with the player protection provisions of the Federal Gaming Act. In addition, when you visit a VLT location for the first time, as part of your registration a current photo will be taken of you for purposes of verifying your identity, which will be stored in the customer database. If necessary, for example if the image captured is obviously no longer up to date, it may be necessary to take a new photo.

WINWIN information and mailings

If you have given your consent, your personal data provided during the registration process and subsequently collected, such as your title, name, address, mobile phone number, e-mail address, data on the use of promotions and your visit and game data, will be processed by WINWIN. You will receive information and mailings about promotions and offers (e.g. free game credits, highlights from the world of lotteries), the range of games, services (e.g. player protection information, customer surveys, advantage clubs), advertising, prize draws and competitions from WINWIN / Austrian Lotteries by post, telephone, e-mail and text message from WINWIN / Austrian Lotteries.

Personal data that you disclose to WINWIN as part of events and competitions will be used for personalised mailings if you have given your consent to this.

As part of the mailings, WINWIN uses analysis software to send you personalised and customised information and direct advertising. More information can be found at Mailings and under Analysis software.

You can find more information on the possibility of withdrawing your consent in the section Right to withdraw consent.

Österreichische Sportwetten

tipp3 user account and app

In order to use the online products and the tipp3 app of Österreichische Sportwetten (“tipp3”) and to participate in the “tipp3 Club” customer loyalty programme of Österreichische Sportwetten, you must register and create a user account. As part of your registration, the following personal data will be processed by Österreichische Sportwetten on the basis of the agreement with you: Your name, your title, your date of birth, your e-mail address, your user administration data (password and user name = e-mail address). As part of the registration process, your name and date of birth will be compared with the CRIF GmbH database or the central register of residents in order to comply with the betting regulations. After your registration, your betting data will be processed by tipp3. As soon as you wish to arrange disbursement of your betting winnings, your bank details will also be recorded and processed.

tipp3 Club

By joining the “tipp3 Club”, you have the opportunity to participate in the Österreichische Sportwetten customer loyalty programme. For the purpose of operating the “tipp3 Club” and for customer support, Österreichische Sportwetten processes personal data, specifically your name, title, date of birth, e-mail address and game data. If you have given your consent, you will receive direct advertising in the form of information and mailings for our own or similar products and services by e-mail.

As part of the “tipp3 Club”, Österreichische Sportwetten uses analysis software to calculate your bonuses and to be able to send and provide you with individualised and personalised direct advertising.

You can find more information on the possibility of withdrawing your consent in the section Right to withdraw consent.

You can find more information at Mailings and Analysis software. The respective benefits and terms of participation can be found at www.tipp3.at/Club.

tipp3 Trafik App

The tipp3 Trafik app is a service app for all sports betting products played in the retail outlet. This app works without registration. It is also possible to place bets via the tipp3 Trafik app by topping up a credit balance in advance at Austrian sports betting outlets. More information on this can be found at Data processing when you use our apps.

You can use the tipp3 App to link your tipp3 user account and the tipp3 Club or carry out a registration.

tipp3 information and mailings

If you have given your consent, you will receive personalised e-mails with information (e.g. as part of online newsletters, tobacconist newsletters, club newsletters) on special offers and promotions (e.g. vouchers, free betting credits), the range of betting offerings, services (e.g. information on player protection, customer surveys and advantage clubs), advertising, prize draws and current games and competitions from Österreichische Sportwetten. As part of the mailings, your personal data, if available and/or disclosed, such as your name, your date of birth and your betting data will be processed by Österreichische Sportwetten.

Österreichische Sportwetten uses analysis software for the mailings in order to be able to send you individualised and personalised direct advertising. For more information, see Mailings and Analysis software.

You can find more information on the possibility of withdrawing your consent in the section Right to withdraw consent.

Group of companies

Mailings with information from companies in the Group

If you have given your consent, you will also receive mailings (by post and electronically by e-mail and text message) from companies in our Corporate Group, containing information from Casinos Austria Aktiengesellschaft and Österreichische Lotterien Gesellschaft m.b.H. Corporate Group (Casinos Austria Aktiengesellschaft, Österreichische Lotterien Gesellschaft m.b.H., Glücks- und Unterhaltungsspiel Betriebsges.m.b.H., Österreichische Sportwetten GmbH, Casinos Austria International Holding GmbH, Cuisino Ges.m.b.H. and Congress Center Baden Betriebsges.m.b.H.).

The mailings contain general and personalised information about promotions and offers (e.g. highlights from the world of lotteries, free games or betting credits), the range of gaming and betting offerings (e.g. poker tournaments, casino tournaments), services (e.g. information about player protection, customer surveys and advantage clubs) and current games and competitions.

The following personal data will only be processed by the respective company for mailings, if you have disclosed them: Your name, title, date of birth, e-mail address, home address and nationality. This data is not passed on or exchanged between the companies in the Group.

More information can be found at Mailings and under Game secrecy.

You can find more information on the possibility of withdrawing your consent in the section Right to withdraw consent.

Cookies

We use cookies on a large number of our Corporate Group websites. Cookies are small text files that are stored on your electronic end device (e.g. computer, smartphone, games console) when you access the websites. They enable your browser to be recognised.

We not only set our own cookies (first-party cookies), but also use the professional services of third-party providers who set cookies on our websites (third-party cookies). You can find out which third-party providers these are and what exactly they do in the cookie policy on the respective website.

We divide cookies into the following categories: necessary/essential cookies, functional cookies, analysis cookies and marketing cookies. A more detailed description and explanation of these categories and the associated data processing can be found in the cookie policies on the respective websites.

An overview of the cookies in use, the third parties that set cookies on our websites and the retention period of the cookies can be found in the cookie policies on the websites.

You can prevent or terminate the retention of cookies by selecting the appropriate settings in your browser software. However, this may mean that not all functions of our websites can be used to their full extent.

When you visit our websites, you will receive information on the use and utilisation of cookies via the cookie banner displayed. In this cookie banner, you can specify which cookies and functionalities you consent to. You can change or withdraw your consent at any time on the respective website.

COOKIE POLICY

Sessions

The websites and apps of win2day (win2day.at) and Österreichische Sportwetten (tipp3.at) and the apps of Casinos Austria (casinos.at and shop.casinos.at/) use sessions. The sessions (session ID, session number) are generated by the server at the start of your session. The session must be transmitted to your computer or smartphone with the response from the server and delivered by it with each subsequent access. With the help of the unique session, the data stored on the server (e.g. your betting slip) can be uniquely linked to a user each time it is accessed. The session is ended by clicking on Logout. After a specified period of inactivity on the win2day and tipp3 websites, you will be automatically logged out and the session will also be terminated.

Analysis Software

Fully automated decision-making processes

There are currently no fully automated decision-making processes within the meaning of Art. 22 GDPR in our Corporate Group, as no purely automated decisions are made that have a legal effect on you or significantly affect you in a similar way.

Profiling for direct marketing purposes

For some mailings, we use analysis software on the basis of your express consent in order to analyse personal data and thus send you individual, personalised offers and direct advertising tailored to your needs and requirements. Based on the data collected as part of the respective customer loyalty and/or newsletter programme, we can provide you with personalised offers and information tailored to your needs.

Furthermore, as part of customer loyalty programmes and/or advantage clubs, you consent to your data being processed by means of analysis software in order to calculate bonuses (e.g. “Lucky points” and status points in the “Glücks Card” bonus programme of Casinos Austria or balls in the tipp3 Club).

The information and mailings for which this software is used are specified in the respective products of the corporate group. Details on how to unsubscribe from the mailings and information on where we use this analysis software can also be found in each individual mailing and in the terms of participation of our bonus programmes/advantage clubs.

Further information on the possibility of withdrawing your consent and objecting to data processing can be found in the sections Right to withdraw consent and Right to object.

Retention period

Data that you have provided to us exclusively for customer service or for marketing and information purposes (e.g. newsletter) will be stored until you withdraw your consent. Irrespective of this, erasure may occur if you have not used our online services or other services and products for more than three years (last contact with us or last use of the services by you).

If a contract is concluded, e.g. as part of a visit to a casino or VLT location or when using our online products, your personal data will be stored after the contract has been fully performed, and will in any case be stored until the expiry of the statutory retention periods applicable to us, and beyond that until the end of any legal disputes in which the data is required as evidence. Ensuring that we fulfil the obligations to which we are subject under general statutory and licensing law in the area of Player protection and for the prevention of money laundering may also require a longer retention period in individual cases.

Legal retention obligations arise for us in particular from the following provisions

• Sec. 212 (1) of the Austrian Commercial Code (UGB),
• Sec. 132(1) of the Federal Fiscal Code (BAO),
• Sec. 21 (1) of the Financial Markets Anti-Money Laundering Act (FM-GwG) and
• provincial betting laws

Your rights

You can assert the following rights under the General Data Protection Regulation and the Austrian Data Protection Act with regard to the processing of your data:

Right to information

You can request information from us as to whether we process your personal data and, if so, what data and to what extent.

Right of rectification

If we process your personal data and such data is incomplete or incorrect, you can request that we rectify and/or complete it at any time.

Right to withdraw consent

You can demand that we erase your personal data if we process it unlawfully, if the processing disproportionately interferes with your legitimate protection interests, if the personal data is no longer necessary for the purposes for which it was collected, if you have withdrawn your consent and there is no other legal basis for the processing or if the erasure is necessary to fulfil a legal obligation. Please note that there may be reasons that prevent immediate erasure, e.g. in the case of statutory retention obligations.

Right to restrict processing

You can request that we restrict the processing of your data if

• you contest the accuracy of the data, for a period enabling us to verify the accuracy of the data;
• the processing of the data is unlawful, but you decline to have it erased and instead request that the use of the data be restricted;
• we no longer need the data for the intended purpose, but you still need this data in order to assert, enforce or defend against legal claims, or
• you have objected to the processing of the data.

Following your request to restrict processing, this data will only be processed on the basis of your case-by-case consent or for the assertion and enforcement of legal claims.

Right to data portability

You may request that we provide you with the data you have provided to us in a structured, commonly used and machine-readable format, provided that

• we process this data on the basis of consent which you have given and which is subject to your withdrawal, or for the performance of a contract between us, and
• this processing is carried out using automated procedures.

Right to withdraw consent

You can withdraw your consent to data processing under data protection law at any time with effect for the future via datenschutz@cal.at or at the e-mail address given in the declaration of consent or by post to Rennweg 44, 1038 Vienna, stating the respective company. In the case of mailings by e-mail, you can also withdraw consent by clicking on the unsubscribe link in each e-mail (“unsubscribe” link). The withdrawal of your consent does not affect the lawfulness of processing based on your consent which occurred prior to its withdrawal.

Right to object

As a basic principle, you can object to the processing of personal data concerning you for reasons arising from your particular situation, even where that data is necessary to protect our legitimate interests or those of a third party. You may do so either at the time when we request your contact data (by opting-out), via datenschutz@cal.at, or by notifying us by post at Rennweg 44, 1038 Vienna, referencing the specific Group company. In the case of mailings by e-mail, you can also object by clicking on the unsubscribe link in each e-mail (“unsubscribe” link). Your data will no longer be processed after your objection unless there are necessary vital reasons for the processing which override your interests, rights and freedoms or where the processing serves the establishment, exercise or defence of legal claims.

You can object to the sending of advertising at any time without giving reasons.

Right to lodge a complaint

If you are of the opinion that we are violating Austrian or European data protection law when processing your data, please contact us so that we can resolve any questions you may have. You also have the right to contact the data protection authority as the competent supervisory authority.

Assertion of rights

If you wish to assert one of the aforementioned rights in respect of us, simply contact us at our email contact address: datenschutz@cal.at.

In connection with your assertion of your rights, we may request additional information to confirm your identity (e.g. presentation of an official photo ID). This serves to protect your rights and your privacy. In particular in order to ensure a high standard of care with regard to gaming secrecy and so that no third party receives information about your data.

We will respond to all reasonable requests as promptly as possible in accordance with applicable law.

Updates to our privacy policy

We will revise our Privacy Policy from time to time. Changes to this Privacy Policy will take effect when they are made available on the websites and apps of our Corporate Group and when they are posted in the casinos and VLT locations. If we make significant changes, we will inform you via our online services.