This document explains the processing of your personal data and the rights that assist you in accordance with current data protection regulations – Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, relating to the protection of natural persons with regard to the processing of personal data, and the regulations that develop it, hereinafter “RGPD”. The type of data processed and its use may vary depending on the relationship we maintain with you and the services requested and/or provided.

1. Data controller and contact details

The entity responsible for processing your data is GRUPO ORENES, SL, with registered office at Avenida Alejandro Valverde, 170 – 30.007 Murcia.

If you wish, you can contact the Data Protection Officer at the following email address: dpo@orenesgrupo.com or at the postal address described above.

2. For what purpose will we process your data (purpose of processing) and on what legal basis?

Personal data is processed in accordance with the provisions of the RGPD, on the legal basis indicated below:

Within the framework of the execution or fulfillment of contractual obligations – Art. 6.1.b RGPD

To fulfill our contractual obligations to you, including to register an account to use our services.

  • Management of contracted services, as well as compliance with accounting, legal, fiscal and administrative obligations.
  • Issue winning certificates to players who request them
  • Manage the record of jackpot prize winners.
  • Management of reservations in hospitality establishments and corroborating their ownership.
  • Management of home delivery orders for hospitality establishments. Delivery of orders.

Justified by a legitimate interest – Art. 6.1.f RGPD

When necessary, GRUPO ORENES, SL will process your personal data to satisfy its own or third-party legitimate interests in the following cases:

  • Management of customer complaints.
  • Carrying out controls to detect fraudulent activities.
  • Register the visits that access the Orenes Group headquarters
  • Management of client information of special relevance and making communications related to invitations to special events.
  • Study and analysis of the identification process and/or activity of clients that meet patterns or signs of fraud.

Consent – ​​Art. 6.1.a GDPR

As long as you have given us your consent, we may carry out additional treatments that are informed to you and that you consent to. You may revoke your consent at any time. This is also applicable in the event that your consent was granted before the entry into force of the EU General Data Protection Regulation, that is, before May 25, 2018. It should be noted that the opposition to a certain processing and The revocation of consent is not retroactive. You can obtain information on the authorizations you have given us for the different treatments at any time by exercising your rights in accordance with section 8.

GRUPO ORENES, SL will request your authorization to process your data for the following purposes:

  • Management of contact data collected through the forms present on the corporate websites.
  • Management of the payment of cash prizes.
  • Sending commercial, promotional and/or advertising communications, which could be based on the contracted products or services provided.
  • The automatic categorization of your user according to my gaming profile in order to receive communications adapted to your preferences and needs. Personal data may be processed to create profiles based on internal sources (e.g. cookie browsing, historical and statistical data) whose results allow the preparation and analysis of personalized products, through segmentation into different groups in relation to patterns. common. These profiles will be used only to send you personalized communications about products and/or services.
  • Provide my contact information to Grupo Orenes companies so they can send me commercial communications about their products and services.
  • Management of photographs of participants in poker tournaments, themed dinners, other organizational events and/or testimonials
  • Verify the identity of clients through a facial recognition system with the aim of facilitating registration and access control to the centers.
  • Capturing images of roulette customers in casino for online reproduction.
  • Management of customer service for the resolution of requests generated by clients or potential clients.
  • Management of the Wi-Fi service in our establishments for clients and visitors.
  • Management of registration of participants in the draws.
  •  Management of satisfaction surveys sent to our clients about our services.

Due to legal imperative or for the benefit of public interest – Art. 6.1.c and 6.1.e RGPD

As a company in the gaming and betting sector, GRUPO ORENES, SL is subject to various legal obligations (e.g., the Gambling Regulation Law, the Prevention of Money Laundering and Terrorism Financing Law, and the Tax Law) and various supervisory regulations.

In this way, we process data with said legal basis in the following cases:

  • Management of the portfolio of players who use the services, including the payment of prizes and the management of entry registration to the facilities.
  • Manage the information of players registered on the online sports betting platform and online casino, including the payment of prizes and access registration.
  • Management of the registry of prohibited players in order to prevent their access to Grupo Orenes facilities or services.
  • Registration of winners and management of prizes over 2.000 euros.
  • Compliance with the legal obligations applicable to Grupo Orenes regarding the Prevention of Money Laundering.
  • Carrying out external audits or reviews to which Grupo Orenes is subject, either by applicable regulation, or carried out voluntarily to verify our internal control framework.
  • Recording of images at Grupo Orenes facilities for security reasons, as well as to collect evidence in cases of theft and/or fraud.
  • Complete the entry forms for hospitality establishments and notify, where appropriate, the State Security Forces and Corps.
  • Management of administrative or judicial files involving clients and Grupo Orenes. This treatment may also be based on the legitimate right of Grupo Orenes to effective judicial protection, both in its right of defense and in the filing of judicial claims that it deems appropriate, based on the regulations of civil or criminal procedure.
  • Manage complaints related to acts or conduct, present or past, contrary to our Code of Ethics or the applicable legislation received through the different channels enabled by the organization, as well as the processing and investigation of the same.
  • Response to the exercises of rights formulated by the interested parties in accordance with the Data Protection regulations.

3 To which recipients will your data be communicated?

To carry out all of the purposes described above, GRUPO ORENES, SL collaborates with third-party service providers who may have access to personal data as a result of the performance of the contracted services. In any case, GRUPO ORENES, SL follows strict criteria for selecting said third parties in order to comply with its data protection obligations and signs the corresponding data protection agreement with them. These third parties undertake to comply with their data protection obligations and, specifically, to comply with the legal, technical, and organizational measures to process personal data for the agreed purposes, and to prohibit the processing of said personal data for other purposes or transferring them to third parties.

Your data may also be communicated to Public Bodies, the Tax Agency, Judges and Courts, and in general to the Competent Authorities when GRUPO ORENES, SL is legally required to provide it.

Likewise, GRUPO ORENES, SL must communicate to the Commission for the Prevention of Money Laundering (SEPBLAC) any indication or suspicion of an operation in the field of combating and preventing money laundering and the financing of terrorism and also inform said Commission, communicating the necessary identifying data of the users involved, so that the information collected is available to judicial bodies in investigations related to money laundering.

The transmission of data to countries outside the European Union (so-called third countries) will only take place when the European Commission has decided that the third country guarantees an adequate level of protection, if required by law (e.g. information obligations tax), if you have given us your authorization in this regard or within the framework of data processing as service providers.

Orenes informs that, to fulfill its purposes of sending advertising by electronic means, it uses a provider located in the United States, called Salesforce, producing an International transfer of data related to its clients. Said provider has binding corporate rules for its services as processor, guaranteeing that the transfer will be carried out under the terms of the content in accordance with the GDPR.

In the same sense, in order to fulfill its customer service purposes, Orenes uses Zendesk, also located in the United States. Said provider guarantees that the transfer will be carried out in the terms of the content in accordance with the GDPR through binding corporate rules for its services as processor.

4. How long will we keep your data?

GRUPO ORENES, SL will comply with current regulations regarding the obligation to delete personal information that is no longer necessary for the purpose or purposes for which it was collected. It will be made available exclusively to judges and courts, the public prosecutor's office, or the competent public authorities to address potential liabilities arising from the processing, and only during the time periods described in these responsibilities. Once these periods have elapsed, this information will be permanently deleted using secure methods.

Access data is saved 6 months from the last visit to the establishment. On the online platform, 6 years are kept from the last access. In the event that the data is covered by Royal Decree 304/2014 that approves the regulations of Law 10/2010 on the Prevention of Money Laundering, the retention period will be extended in accordance with article 29.1, which states that “The subjects The obligated parties will retain documents and maintain adequate records of all business relationships and operations, national and international, for a period of ten years from the termination of the business relationship or the execution of the occasional operation. The records must allow the reconstruction of individual operations so that they can have, if necessary, an evidentiary effect.”

Based on Instruction 1/2006 of the Spanish Data Protection Agency, the information on video surveillance will be canceled within 1 month from the capture of the images.

In hospitality establishments, they must keep the record books for a period of three years, counting from the date of the last of the record sheets that make them up, in accordance with Order INT/1922/2003, of 3 July, on record books and entry reports of travelers in hospitality and other similar establishments.

In relation to the management of the Wi-Fi service in our establishments, the connection data will be kept for as long as the user is connected to the Wi-Fi network and, subsequently, they will remain blocked during the periods derived from the prescription of the legal actions related to this treatment.

5. Registration of personal data

As the controller of your personal data, GRUPO ORENES, SL keeps a record of all data processing activities. This inventory contains all the information about the type of data processed, the data subjects, potential recipients, the purposes of the processing, and the length of time the data will be retained, among other details.

The personal data provided by the user is kept in a registry controlled by GRUPO ORENES, SL, which therefore remains responsible for its security at all times. In addition to the information above, this registry includes:

  • The department responsible for the treatment
  • The legitimacy of the treatment
  • The category of treatment data
  • The origin of the treatment data
  • The channel for obtaining treatment data
  • The medium on which the treatment data is stored
  • A description of the treatment performed
  • A list of the systems involved in the treatment
  • The person in charge of data processing

6. Changes to the Privacy Policy

GRUPO ORENES, SL reserves the right to modify the Privacy Policy. Any updates will be applicable to users once published. GRUPO ORENES, SL undertakes to notify such changes by any available means and to expressly indicate the date on which each version of the Privacy Policy enters into force.

7. Probative value

The user accepts that in the event that the channel for obtaining the documents or data processed is an electronic medium, they have the same evidentiary value as if said documents and data had been sent or communicated on paper. Therefore, they undertake not to challenge its validity or probative value due to the fact that it is in electronic format.

8. What are your rights when you provide us with your data?

In accordance with the provisions of the General Data Protection Regulation, as well as the national regulations on data protection, you have the right to exercise, if you wish, the rights of access, rectification and deletion of data, as well as such as requesting that the processing of your personal data be limited, opposing it, requesting the portability of your data, as well as not being subject to automated individual decisions. In particular, regardless of the purpose or legal basis under which we process your data, you have the right to:

Request access to your data that we have.

Request that we rectify the data we already have. Please note that by actively providing us with your personal data by any means, you guarantee that it is true and accurate and you agree to notify us of any changes or modifications thereof.

Request that we delete your data to the extent that it is no longer necessary for the purpose for which we need to process it as we have previously informed you, or that we no longer have the legitimacy to do so.

Request that we limit the processing of your data, which means that in certain cases you can ask us to temporarily suspend the processing of the data or to keep it beyond the time necessary when you may need it.

Receive the personal data that concerns you and that you have provided to us, in a structured, commonly used and machine-readable format, as well as transmitting it to another data controller.

On the other hand, when the processing of your data is based on our legitimate interest, you will also have the right to object to the processing of your data.

Additionally, if the processing of personal data described is based on the consent given by you, you can revoke said consent at any time. In this sense, it should be noted that the revocation of the consent given will not affect the legality of the processing carried out prior to the withdrawal of said consent.

You can exercise the rights described above through the following channels. If we consider it necessary to identify you, we may request a copy of a document proving your identity (copy of DNI, passport, NIE, etc.):

  • In writing, by means of a request addressed to GRUPO ORENES, SL Avenida Alejandro Valverde, 170, 30007 Murcia.
  • By email to the following address dpo@orenesgrupo.com

GRUPO ORENES, SL undertakes to provide a copy of the personal data being processed and reserves the right to charge a reasonable fee based on administrative costs for any additional copies requested by the data subject.

Users have the right to access or receive the information, or a copy of it, in a commonly used structured electronic format, unless the interested party requests it in another format.

9. Am I obliged to provide information?

Within the framework of our commercial relationship, you must provide us with personal data that requires your consent for the provision of a service, or that is necessary for the fulfillment of derived contractual obligations, or whose collection we are required by law.

If you do not provide us with such data, we will generally be forced to refuse to provide the service, or we will not be able to continue providing the existing service and we will be forced to terminate our business relationship.

In particular, in accordance with the legal provisions on the prevention of money laundering, prior to the beginning of the commercial relationship we are obliged to identify you, for example, through your national identity document and to collect and store your name and surname, place and date of birth, nationality, as well as address. You must also inform us of possible changes that may arise during the course of the commercial relationship. If you do not provide us with the necessary information and documentation, we will not be able to establish or continue the business relationship you wish to establish.

10. Before whom can you make your claims?

If you understand that your data protection rights have been violated or you have any claim regarding your personal information, you can contact us through the channels provided in section 8.

In any case, interested parties may always go to the Spanish Data Protection Agency, the supervisory authority in matters of data protection, http://www.agpd.es, Jorge Juan, 6 – 28001 Madrid.