This document sets out the processing of your personal data and the rights you have under current data protection regulations—Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, and the regulations implementing it, hereinafter "GDPR." The type of data processed and its use may vary depending on the relationship we maintain with you and the services requested and/or provided.

1. Data controller and contact information

The entity responsible for processing your data is GRUPO ORENES, SL, with registered office at Avenida de Alicante, 170, CP 30.007 (Murcia).

If you wish, you can contact the Data Protection Officer through the following email address. dpo@orenesgrupo.com or through the postal address described above.

2. For what purpose will we process your data (purpose of processing) and on what legal basis?

Personal data is processed in accordance with the provisions of the RGPD, on the legal basis indicated below:

Within the framework of the execution or fulfillment of contractual obligations -Art. 6.1 b) GDPR-

To fulfill our contractual obligations to you, including to register an account to use our services.

  • Management of contracted services.
  • Compliance with accounting, legal, fiscal and administrative obligations.

Justified by a legitimate interest -Art. 6.1. f) GDPR-

When necessary, GRUPO ORENES, SL will process your personal data to satisfy its own or third-party legitimate interests in the following cases:

  • Recording images at Orenes facilities for security purposes, as well as to collect evidence in cases of theft and/or fraud.
  • Management of customer complaints.
  • Management of customer service for the resolution of requests generated by clients or potential clients.
  • Carrying out controls to detect fraudulent activities.

Consent -Art. 6.1a) GDPR-

As long as you have given us your consent, we may carry out additional treatments that are informed to you and that you consent to. You may revoke your consent at any time. This is also applicable in the event that your consent was granted before the entry into force of the EU General Data Protection Regulation, that is, before May 25, 2018. It should be noted that the opposition to a certain processing and The revocation of consent is not retroactive. You can obtain information on the authorizations you have given us for the different treatments at any time by exercising your rights in accordance with section 8.

GRUPO ORENES, SL will request your authorization to process your data for the following purposes:

  • Management of contact data collected through the forms present on the corporate websites.
  • Management of the payment of cash prizes.
  • Managing the registration of jackpot prize winners.
  • Management and publication of photographs of event participants.
  • Sending commercial, promotional and/or advertising communications, which could be based on the contracted products or services provided.
  • Automatic categorization of my user based on my gaming profile for the purpose of receiving communications tailored to my preferences and needs. Personal data may be processed to create profiles based on internal sources (e.g., browsing data from cookies, historical and statistical data), the results of which allow for the creation and analysis of personalized products through segmentation into different groups based on common patterns. Such profiling will be used solely to send you personalized communications about products and/or services.

In addition, our Casino division will also require your consent to:

  • Providing informational communications about the organization of themed dinners to interested clients.
  • Making communications regarding invitations to special events.
  • Providing informational communications about the organization of poker tournaments to players subscribed to the Poker Club.
  • Management and publication of photographs of poker tournament participants.

By legal imperative or for the benefit of the public interest -Art. 6.1 c) and e) GDPR-

As a company in the gaming and betting sector, GRUPO ORENES, SL is subject to various legal obligations (e.g., the Gambling Regulation Law, the Prevention of Money Laundering and Terrorism Financing Law, and the Tax Law) and various supervisory regulations.

In this way, we process data with said legal basis in the following cases:

  • Management of the player portfolio that uses the services offered by Bingos and Casinos, including the payment of prizes and the management of check-in to the facilities.
  • Management of the player portfolio registered on the Online Sports Betting and Online Casino platform, including managing entry registration to in-person betting facilities.
  • Management of administrative or judicial files involving clients and Orenes. This processing may also be based on Orenes' legitimate right to effective judicial protection, both in its right to defense and in the filing of legal claims it deems appropriate, based on civil or criminal procedural regulations.
  • Issuance of winnings certificates to players who request them.
  • Registration of winners and management of prizes over €2.500.
  • Managing the registry of banned players to prevent their access to Grupo Orenes facilities.
  • Management of liens imposed on clients in order to comply with the legal obligations applicable to Orenes.
  • Compliance with the legal obligations applicable to Orenes regarding the Prevention of Money Laundering.
  • Conducting external audits or reviews to which Orenes is subject, either by applicable regulations or carried out voluntarily to verify our internal control framework.

3 To which recipients will your data be communicated?

To carry out all of the purposes described above, GRUPO ORENES, SL collaborates with third-party service providers who may have access to personal data as a result of the performance of the contracted services. In any case, GRUPO ORENES, SL follows strict criteria for selecting said third parties in order to comply with its data protection obligations and signs the corresponding data protection agreement with them. These third parties undertake to comply with their data protection obligations and, specifically, to comply with the legal, technical, and organizational measures to process personal data for the agreed purposes, and to prohibit the processing of said personal data for other purposes or transferring them to third parties.

Your data may also be communicated to Public Bodies, the Tax Agency, Judges and Courts, and in general to the Competent Authorities when GRUPO ORENES, SL is legally required to provide it.

Likewise, GRUPO ORENES, SL must communicate to the Commission for the Prevention of Money Laundering (SEPBLAC) any indication or suspicion of an operation in the field of combating and preventing money laundering and the financing of terrorism and also inform said Commission, communicating the necessary identifying data of the users involved, so that the information collected is available to judicial bodies in investigations related to money laundering.

The transmission of data to countries outside the European Union (so-called third countries) will only take place when the European Commission has decided that the third country guarantees an adequate level of protection, if required by law (e.g. information obligations tax), if you have given us your authorization in this regard or within the framework of data processing as service providers.

Orenes informs you that, to fulfill its electronic advertising purposes, it uses a provider located in the United States, called MailChimp, which involves an international transfer of customer data. This provider adheres to the Privacy Shield Agreement, which regulates international transfers between data controllers located in the European Union and those located in the United States. This agreement guarantees that the transfer will be carried out in accordance with the terms of the agreement and that the provider will process your data in accordance with the stipulations set forth in said agreement.

If you give us your consent, your data may be transferred to the following companies within the Orenes Group. More Information.

4. How long will we keep your data?

GRUPO ORENES, SL will comply with current regulations regarding the obligation to delete personal information that is no longer necessary for the purpose or purposes for which it was collected. It will be made available exclusively to judges and courts, the public prosecutor's office, or the competent public authorities to address potential liabilities arising from the processing, and only during the time periods described in these responsibilities. Once these periods have elapsed, this information will be permanently deleted using secure methods.

In the event that the data is covered by Royal Decree 304/2014, which approves the regulations of Law 10/2010 on the Prevention of Money Laundering, the retention period will be extended in accordance with Article 29.1, which provides that "Obligated parties shall retain documents and maintain appropriate records of all business relationships and transactions, both national and international, for a period of ten years from the termination of the business relationship or the execution of the occasional transaction. These records must allow for the reconstruction of individual transactions so that they can serve as evidence, if necessary."

Based on Instruction 1/2006 of the Spanish Data Protection Agency, the information on video surveillance will be canceled within 1 month from the capture of the images.

5. Registration of personal data

As the controller of your personal data, GRUPO ORENES, SL keeps a record of all data processing activities. This inventory contains all the information about the type of data processed, the data subjects, potential recipients, the purposes of the processing, and the length of time the data will be retained, among other details.

The personal data provided by the user is kept in a registry controlled by GRUPO ORENES, SL, which therefore remains responsible for its security at all times. In addition to the information above, this registry includes:

  • The department responsible for the treatment
  • The legitimacy of the treatment
  • The category of treatment data
  • The origin of the treatment data
  • The channel for obtaining treatment data
  • The medium on which the treatment data is stored
  • A description of the treatment performed
  • A list of the systems involved in the treatment
  • The person in charge of data processing

6. Changes to the Privacy Policy

GRUPO ORENES, SL reserves the right to modify the Privacy Policy. Any updates will be applicable to users once published. GRUPO ORENES, SL undertakes to notify such changes by any available means and to expressly indicate the date on which each version of the Privacy Policy enters into force.

7. Probative value

The user accepts that in the event that the channel for obtaining the documents or data processed is an electronic medium, they have the same evidentiary value as if said documents and data had been sent or communicated on paper. Therefore, they undertake not to challenge its validity or probative value due to the fact that it is in electronic format.

8. What are your rights when you provide us with your data?

In accordance with the provisions of the General Data Protection Regulation, as well as national data protection regulations, you have the right to exercise, if you so wish, the rights of access, rectification, and deletion of data, as well as to request that the processing of your personal data be restricted, object to it, request data portability, and not be subject to automated individual decisions.

Additionally, if the processing of personal data described is based on the consent given by you, you can revoke said consent at any time. In this sense, it should be noted that the revocation of the consent given will not affect the legality of the processing carried out prior to the withdrawal of said consent.

You can exercise the rights described above through the following channels, providing the necessary documentation that allows us to verify your identity (copy of your ID, passport, NIE, etc.):

  • In writing, by means of a request addressed to GRUPO ORENES, SL Avenida de Alicante, 170, CP 30.007 (Murcia).
  • By email to the following address dpo@orenesgrupo.com

GRUPO ORENES, SL undertakes to provide a copy of the personal data being processed and reserves the right to charge a reasonable fee based on administrative costs for any additional copies requested by the data subject.

Users have the right to access or receive the information, or a copy of it, in a commonly used structured electronic format, unless the interested party requests it in another format.

9. Am I obliged to provide information?

Within the framework of our commercial relationship, you must provide us with personal data that requires your consent for the provision of a service, or that is necessary for the fulfillment of derived contractual obligations, or whose collection we are required by law.

If you do not provide us with such data, we will generally be forced to refuse to provide the service, or we will not be able to continue providing the existing service and we will be forced to terminate our business relationship.

In particular, in accordance with the legal provisions on the prevention of money laundering, prior to the beginning of the commercial relationship we are obliged to identify you, for example, through your national identity document and to collect and store your name and surname, place and date of birth, nationality, as well as address. You must also inform us of possible changes that may arise during the course of the commercial relationship. If you do not provide us with the necessary information and documentation, we will not be able to establish or continue the business relationship you wish to establish.

10. Before whom can you make your claims?

If you understand that your data protection rights have been violated or you have any claim regarding your personal information, you can contact us through the channels provided in section 8.

In any case, interested parties may always go to the Spanish Data Protection Agency, the supervisory authority in matters of data protection, http://www.agpd.es, C/Jorge Juan number 6, 28001, Madrid.