This document sets out the processing of your personal data and your rights under current data protection regulations – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data, and the regulations implementing it, hereinafter “GDPR”. The type of data processed and the use of such data may vary depending on the relationship we have with you, and the services requested and/or provided.
- Data controller and contact details
The entity responsible for the processing of your data is ORENES GROUP, S.L., with registered office at Avenida de Alicante, 170, C.P. 30.007 (Murcia).
If you wish, you can contact the Data Protection Delegate via the following e-mail address firstname.lastname@example.org or via the postal address described above.
- For what purpose will we process your data (object of processing) and on what legal basis?
Personal data is processed in accordance with the provisions of the GDPR on the following legal basis:
In the context of the performance or fulfilment of contractual obligations – Art. 6.1 b) GDPR-.
To fulfil our contractual obligations to you, including to register an account to use our services.
- Management of contracted services.
- Fulfilment of accounting, legal, tax and administrative obligations.
Justified by a legitimate interest -Art. 6.1. f) GDPR-.
When necessary, ORENES GROUP, S.L. will process your personal data to satisfy its own or third parties’ legitimate interests in the following cases:
- Recording of images on Orenes premises for security reasons, as well as to collect evidence in cases of theft and/or fraud.
- Management of customer complaints.
- Management of customer service for the resolution of requests generated by customers or potential customers.
- Performing controls for the detection of fraudulent activities.
Consent -Art. 6.1a) GDPR-.
Provided that you have given us your consent, we may carry out the additional processing operations of which you have been informed and to which you consent. You may revoke your consent at any time. This also applies if your consent was given before the entry into force of the EU General Data Protection Regulation, i.e. before 25 May 2018. It should be noted that objections to a particular processing operation and revocation of consent are not retroactive. You can at any time obtain information on the authorisations you have granted us for the various processing operations by exercising your rights in accordance with section 8.
ORENES GROUP, S.L. will request your authorisation to process your data for the following purposes:
- Management of the contact data collected through the forms on the corporate web pages.
- Management of the payment of cash prizes.
- Management of the registration of jackpot winners.
- Management and publication of photographs of participants in events.
- Sending commercial, promotional and/or advertising communications, which may be based on the products contracted or services provided.
- The automatic categorisation of my user according to my gaming profile in order to receive communications tailored to my preferences and needs. Personal data may be processed for profiling based on internal sources (e.g. cookies, historical and statistical navigation data) whose results allow the creation and analysis of personalised products, through segmentation into different groups in relation to common patterns. Such profiling will only be used to send you personalised communications about products and/or services.
Likewise, our Casinos division will also require your consent to:
- Make informative communications about the organisation of themed dinners to interested customers.
- To send you information about invitations to special events.
- Make nformative communications about the organisation of poker tournaments to players subscribed to the Poker Club.
- Management and publication of photographs of participants in poker tournaments.
By law or in the public interest -Art. 6.1 c) and e) GDPR-.
As a company in the gaming and betting sector, ORENES GROUP, S.L. is subject to various legal obligations (e.g. Gambling Regulation Act, Prevention of Money Laundering and Terrorist Financing Act, Tax Act), and various supervisory regulations.
Thus, we process data on this legal basis in the following cases:
- Management of the portfolio of players who make use of the services offered by Bingos and Casinos, including the payment of prizes and the management of the registration of entry to the facilities.
- Management of the portfolio of players registered on the Online Sports Betting and Online Casino platform, including the management of the registration of entry to the on-site betting facilities.
- Management of administrative or judicial proceedings involving customers and Orenes. This processing may also be based on Orenes’ legitimate right to effective judicial protection, both in its right of defence and in the filing of any legal claims it deems appropriate, based on civil or criminal prosecution regulations.
- Issuance of winnings certificates to players who request them. Registration of winners and management of prizes in excess of €2,500.
- Management of the register of banned players in order to prevent their access to Orenes Group facilities.
- Management of embargoes imposed on customers in order to comply with the legal obligations applicable to Orenes.
- Compliance with the legal obligations applicable to Orenes regarding the Prevention of Money Laundering.
- External audits or reviews to which Orenes is subject, either by applicable regulation, or carried out voluntarily to verify our internal control framework.
- To which recipients will your data be communicated?
In order to carry out all the purposes described above, ORENES GROUP, S.L. has the collaboration of third party service providers who may have access to personal data as a result of the execution of the contracted services. In any case, ORENES GROUP, S.L. follows strict selection criteria for these third parties in order to comply with its data protection obligations and signs the corresponding data protection agreement with them, in which these third parties undertake to comply with their data protection obligations, and specifically, to comply with the legal, technical and organisational measures, to process personal data for the agreed purposes, and to prohibit the processing of such personal data for other purposes or transfer to third parties.
Your data may also be communicated to Public Bodies, the Tax Agency, Judges and Courts and in general to the Competent Authorities when ORENES GROUP, S.L. is legally obliged to provide them.
Likewise, ORENES GROUP, S.L. must inform the Commission for the Prevention of Money Laundering (SEPBLAC) of any indication or suspicion of an operation in the field of the fight against and prevention of money laundering and the financing of terrorism and also inform the said Commission, communicating the necessary identification data of the users involved, so that the information collected is available to judicial bodies in the event of investigations related to money laundering.
The transfer of data to countries outside the European Union (so-called third countries) will only take place if the European Commission has decided that the third country ensures an adequate level of protection, if it is required by law (e.g. tax reporting obligations), if you have given us your consent or within the framework of data processing as a service provider.
Orenes informs that, in order to fulfil its purposes of sending advertising by electronic means, it uses a provider located in the United States, called MailChimp, which is an international transfer of data relating to its customers. This provider is adhered to the Privacy Shield agreement, which regulates international transfers between those responsible located in the European Union and those located in the United States, guaranteeing that the transfer will be carried out under the terms of the content of the agreement and that the provider will treat your data in accordance with the stipulations in this agreement reflected.
- How long will we keep your data?
ORENES GROUP, S.L. will comply with the provisions of current legislation regarding the duty to delete personal information that is no longer necessary for the purpose or purposes for which it was collected, remaining at the exclusive disposal of Judges and Courts, the Public Prosecutor or the competent Public Administrations for the attention of possible liabilities arising from the treatment, and only during the periods of description of these responsibilities. Once these periods have elapsed, this information will be definitively deleted by means of secure methods.
In the event that the data is covered by Royal Decree 304/2014 approving the regulations of Law 10/2010 on the Prevention of Money Laundering, the retention period shall be extended in accordance with Article 29.1, which provides that “Obliged entities shall keep documents and maintain adequate records of all business relationships and transactions, national and international, for a period of ten years from the termination of the business relationship or the execution of the occasional transaction. The records shall allow for the reconstruction of individual transactions so that they can, if necessary, have evidentiary effect”.
Based on Instruction 1/2006 of the Spanish Data Protection Agency, video surveillance information shall be cancelled within 1 month of the capture of the images.
- Registration of personal data
As the party responsible for the processing of your personal data, ORENES GROUP, S.L. keeps a record of all data processing activities. This inventory contains all the information on the type of data processed, such as the data subjects, the possible recipients of the data, the purposes of the processing or the length of time the data will be kept, among other details.
The personal data provided by the user is kept in a register controlled by ORENES GROUP, S.L. and therefore remains responsible for its security at all times. In addition to the above information, this register includes:
- The department responsible for the processing The legitimacy of the processing.
- The category of the data being processed
- The origin of the processing data
- The channel through which the processing data is obtained
- the medium on which the processing data are stored a description of the processing carried out
- A list of the systems involved in the processing
- The data processor
- Probative Value
The user accepts that in the event that the channel for obtaining the documents or data processed is an electronic medium, these have the same probative value as if said documents and data had been sent or communicated on paper. They therefore undertake not to contest their validity or evidentiary value on the grounds that they are in electronic form.
- What are your rights when you provide us with your data?
In accordance with the provisions of the General Data Protection Regulation, as well as national data protection regulations, you have the right to exercise, if you so wish, the rights of access, rectification and deletion of data, as well as to request the restriction of the processing of your personal data, to object to the processing, to request the portability of your data, as well as not to be subject to automated individual decisions.
In addition, if the processing of personal data described above is based on your consent, you may revoke this consent at any time. In this regard, it should be noted that the revocation of the consent given does not affect the lawfulness of the processing carried out prior to the withdrawal of such consent.
You may exercise the rights described above through the following channels, providing the necessary documentation that allows us to verify your identity (copy of ID card, passport, NIE, etc.):
- In writing, by means of a request addressed to ORENES GROUP, S.L. Avenida de Alicante, 170, C.P. 30.007 (Murcia).
- By e-mail to the following address email@example.com
ORENES GROUP, S.L. undertakes to provide a copy of the personal data being processed and reserves the right to charge a reasonable fee based on administrative costs for any other copy requested by the interested party.
Users are entitled to access or receive the information, or a copy of it, in a commonly used structured electronic format, unless the data subject requests it in another format.
- Am I obliged to provide information?
Within the framework of our business relationship, you must provide us with personal data which requires your consent for the provision of a service, or which is necessary for the fulfilment of contractual obligations arising from, or the collection of which we are obliged by law to collect.
If you do not provide us with such data, we will generally be obliged to refuse to provide the service, or we will no longer be able to provide the existing service and will be obliged to terminate our business relationship.
In particular, in accordance with the legal provisions on the prevention of money laundering, we are obliged to identify you, e.g. by means of your national identity card, and to collect and store your first and last name, place and date of birth, nationality and address prior to the commencement of the business relationship. You must also inform us of any changes that occur during the course of the business relationship. If you do not provide us with the necessary information and documentation, we will not be able to establish or continue the business relationship you wish to enter into.
- To whom can you address your complaints?
If you believe that your data protection rights have been violated or if you have any complaints regarding your personal information, you may contact us through the channels provided in section 8.
In any case, interested parties can always go to the Spanish Data Protection Agency, the supervisory authority for data protection, http://www.agpd.es, C/ Jorge Juan number 6, 28001, Madrid.