- Introduction
This Privacy Policy sets out how personal data is collected, used, stored, shared and protected in connection with the operation of Grosvenor Casino Southwark. For the purposes of this document, Grosvenor Casino Southwark is referred to as “the company”, “the casino” or “the premises”. The policy applies to individuals who visit the premises, use services provided by the casino or otherwise interact with the casino.
This document is issued in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
By using the services of the casino or by providing personal data to the casino, you acknowledge that you have read and understood this Privacy Policy. The policy may be updated periodically to reflect changes in law, regulatory guidance or internal practices. The current version of this policy is available at the premises and through official communications of the casino. Where material changes are made, reasonable steps will be taken to notify affected individuals.
- Data Controller
Grosvenor Casino Southwark is the data controller responsible for personal data processed under this policy. As data controller, Grosvenor Casino Southwark determines the purposes and means by which personal data is processed.
Any queries regarding this policy or the exercise of data protection rights should be directed to Grosvenor Casino Southwark using the contact details provided in Section 9 of this document.
- Personal Data Collected
Personal data is collected and processed in connection with the operation of the casino and the fulfilment of legal and regulatory obligations. The categories of personal data that may be collected include, but are not limited to, the following:
- Identity and contact information, including full name, date of birth, residential address, email address and telephone number.
- Identity verification documents, including copies of passports, driving licences or other government-issued identification, as required for age verification, anti-money laundering checks and customer due diligence.
- Financial information, including details necessary to process transactions and to comply with anti-money laundering obligations.
- Gaming activity records, including records of visits, gaming history and any interactions relevant to responsible gambling monitoring.
- Special category data, including information such as ethnicity or nationality, where processing is required to meet legal or regulatory obligations. Such data is not processed for any other purpose without explicit consent.
- Correspondence and enquiry records, including communications submitted by post, email or in person.
- Purposes and Legal Bases for Processing
Personal data is processed only where a lawful basis exists under UK GDPR. The purposes for which personal data is processed, together with the corresponding legal bases, include:
Age verification and customer due diligence
- Legal basis: Legal obligation
Anti-money laundering and fraud prevention
- Legal basis: Legal obligation; legitimate interests
Compliance with Gambling Commission licence conditions
- Legal basis: Legal obligation
Responsible gambling monitoring and intervention
- Legal basis: Legal obligation; substantial public interest
Delivery of services under a customer agreement
- Legal basis: Performance of a contract
Internal analysis and service improvement
- Legal basis: Legitimate interests
Direct marketing (where applicable)
- Legal basis: Legitimate interests; consent (where required)
Sharing with regulators and law enforcement
- Legal basis: Legal obligation; substantial public interest
Where legitimate interests are relied upon as a legal basis, an assessment is carried out to ensure that such interests do not override the rights and freedoms of the individuals concerned. Where consent is the legal basis, individuals retain the right to withdraw consent at any time, subject to the limitations described in Section 7.
- Sharing of Personal Data
Personal data may be shared with third parties only to the extent necessary for the purposes described in this policy and where a lawful basis exists. Categories of recipients include:
- Regulatory and law enforcement authorities, including the UK Gambling Commission, the Information Commissioner’s Office, HM Revenue and Customs and law enforcement agencies, where required by law or in response to a valid legal request. Statutory requests will only be complied with where accompanied by a warrant, court order or other legally valid proof of authority.
- Risk, fraud and crime prevention agencies, including organisations involved in the detection and prevention of financial crime, money laundering and problem gambling.
- Sports integrity bodies and related associations, where disclosure is required under applicable regulatory frameworks.
- IT and operational service providers, including companies that support technical infrastructure, data storage and operational systems. Such providers are required to process data only on documented instructions and in accordance with applicable data protection law.
- Direct marketing and analytics providers, including third-party services used to support marketing activities, where permitted by law and subject to appropriate safeguards.
- Other entities within the same corporate group as Grosvenor Casino Southwark, where relevant to the operation of the business and subject to equivalent data protection standards.
Personal data is not sold to third parties.
- Data Retention
Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, or as required by law or regulation. Retention periods are determined by reference to legal obligations, including anti-money laundering requirements, taxation obligations and Gambling Commission licence conditions.
In general, records relating to customer due diligence and gaming activity are retained for a minimum of five years from the end of the relevant business relationship or transaction, in line with applicable anti-money laundering legislation. Where longer retention is required by law or regulatory guidance, data will be retained for the applicable period.
- Your Rights
Under UK GDPR and the Data Protection Act 2018, individuals have the following rights in relation to their personal data:
- Right to be informed: The right to receive clear and transparent information about how personal data is processed, as set out in this policy.
- Right of access: The right to submit a Subject Access Request to obtain a copy of the personal data held and information about how it is processed.
- Right to rectification: The right to request correction of inaccurate or incomplete personal data.
- Right to erasure: In certain circumstances, the right to request deletion of personal data. This right is subject to limitations where processing is required by law or for the establishment, exercise or defence of legal claims.
- Right to restrict processing: The right to request that processing of personal data be limited in specified circumstances.
- Right to data portability: Where processing is based on consent or contract and carried out by automated means, the right to request that personal data be provided in a structured, commonly used and machine-readable format.
- Right to object: The right to object to processing based on legitimate interests, including direct marketing and profiling. Where an objection is made to direct marketing, processing for that purpose will cease without requiring justification.
- Rights related to automated decision-making: The right not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal or similarly significant effects, unless an exception applies.
To exercise any of these rights, contact details in Section 9 should be used. A response will be provided within one calendar month of receiving a valid request. Proof of identity may be requested before a request is processed.
Withdrawal of consent or the exercise of certain rights may affect the ability of the casino to provide some or all services where processing is necessary for their delivery.
- Data Security
Appropriate technical and organisational measures are implemented to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These measures are reviewed and updated in line with applicable standards and taking into account the nature of the data held. Access to personal data is restricted to personnel who require it for the performance of their duties, and relevant staff are subject to confidentiality obligations.
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, the Information Commissioner’s Office will be notified within 72 hours of the breach being identified, where required by law. Where the breach is likely to result in a high risk to individuals, affected individuals will also be notified without undue delay.
- Contact and Complaints
For any queries relating to this Privacy Policy, to exercise data protection rights or to raise a concern about data processing practices, contact Grosvenor Casino Southwark using the address or contact details available at the premises or through official communications.
If you are not satisfied with the response to a privacy concern, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters. The ICO can be contacted via ico.org.uk or by telephone on 0303 123 1113.
- Regulatory Framework
This policy is governed by UK GDPR and the Data Protection Act 2018. Data processing activities carried out by Grosvenor Casino Southwark are also subject to the requirements of the UK Gambling Commission, including conditions relating to anti-money laundering, social responsibility and the protection of vulnerable persons.
Where processing of personal data is necessary to fulfil a licence obligation, reliance is placed on the relevant legal bases provided under UK data protection legislation, including those applicable to substantial public interest and the prevention or detection of unlawful acts.