- Introduction
This Privacy Policy describes how personal data is collected, processed, stored, and protected in connection with access to and use of the services of Carlton Casino Club. The Policy applies to users located in Ireland and in other states of the European Economic Area.
Personal data is handled in accordance with the General Data Protection Regulation (GDPR) and applicable Irish and EU data protection legislation. By accessing or using the services, you acknowledge that your personal data will be processed as set out in this Privacy Policy.
The Policy applies to personal data collected through the website, account registration processes, customer support interactions, and any other point of contact between you and Carlton Casino Club.
- Data Controller
Carlton Casino Club is the data controller in respect of personal data collected from users of the services. As data controller, Carlton Casino Club determines the purposes and means of processing personal data.
Questions regarding this Privacy Policy or the exercise of data subject rights can be addressed using the contact details set out in Section 9.
- Personal Data Collected
The following categories of personal data may be collected and processed.
3.1 Identity and Contact Data
- Full name
- Date of birth
- Residential address
- Email address
- Telephone number
This data is collected, for example, during account registration and identity verification procedures.
3.2 Account and Transaction Data
- Account credentials
- Login history
- Transaction records
- Account activity logs
This data is generated through use of the services and is retained for compliance, security, and record-keeping purposes.
3.3 Technical Data
- IP address
- Browser type
- Device identifiers
- Operating system
- Session data
This data is collected automatically when the website is accessed.
3.4 Communications Data
- Records of correspondence between you and Carlton Casino Club, including support requests, complaints, and related responses.
3.5 Verification Data
- Copies of identity documents
- Proof of address
- Source of funds documentation
This data is submitted and processed as part of Know Your Customer (KYC) and Anti-Money Laundering (AML) procedures and other regulatory checks.
- Legal Bases for Processing
Personal data is processed only where a lawful basis exists under GDPR. Depending on the circumstances, the following legal bases apply:
- Contractual necessity: processing required to take steps at your request prior to entering into a contract or to fulfil obligations to you as an account holder.
- Legal obligation: processing required to comply with legal and regulatory obligations, including AML, fraud prevention, tax, accounting, and gambling regulation.
- Legitimate interests: processing for purposes such as security, fraud detection, internal analytics, and service integrity, provided that your interests and fundamental rights do not override those interests.
- Consent: processing for specific purposes, such as certain marketing communications, where you have provided explicit and valid consent.
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
- Use of Personal Data
Personal data may be used for the following purposes:
- Verification of identity and age in accordance with legal and regulatory obligations.
- Administration, maintenance, and operation of user accounts.
- Detection, investigation, and prevention of fraudulent, unlawful, or suspicious activity.
- Compliance with applicable gambling regulation, anti-money laundering requirements, and other legal and regulatory obligations.
- Handling of enquiries, complaints, and customer support requests.
- Sending of marketing communications where valid consent has been provided and to the extent permitted by applicable law, including managing opt-in and opt-out preferences.
- Fulfilment of responsible gambling obligations, including monitoring of account activity for indicators of problem gambling and implementing related measures where required by law or regulation.
- Data Sharing and Disclosure
Personal data is not sold to third parties. Personal data may be shared or disclosed in the following circumstances:
- With service providers that support the operation of the platform, including hosting providers, analytics providers, identity verification providers, payment and IT service providers. Such service providers act under contractual obligations to process personal data only on documented instructions of Carlton Casino Club and in accordance with GDPR and applicable data protection laws.
- With regulatory authorities, law enforcement agencies, governmental bodies, financial institutions, and other investigatory organisations where required or permitted by law, including for fraud prevention, detection of unlawful activity, prevention of money laundering, and compliance with gambling licence conditions.
- In connection with a proposed or actual corporate restructuring, merger, acquisition, transfer of business, or similar transaction. In such cases, personal data may be transferred to a successor entity, subject to data protection obligations that provide an equivalent level of protection.
- With professional advisers, including legal, audit, and compliance consultants, where this is necessary for the establishment, exercise, or defence of legal claims or for compliance and risk management purposes, subject to confidentiality obligations.
Personal data is not transferred outside the European Economic Area unless appropriate safeguards are in place in accordance with GDPR, such as adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms.
- Data Retention
Personal data is retained only for as long as necessary for the purposes for which it was collected or as required under applicable laws and regulations.
- Account data and transaction records are retained for at least the minimum period required under anti-money laundering legislation, gambling regulatory obligations, and other applicable legal requirements.
- Following account closure, personal data is retained for the legally required period and then securely deleted or anonymised, unless continued retention is required for the establishment, exercise, or defence of legal claims.
- Technical and session data is retained for a period consistent with its operational purpose, security requirements, and applicable legal obligations, after which it is deleted or anonymised.
- Rights Under GDPR
Data subjects located in Ireland or in the EEA have the following rights in relation to their personal data, subject to the conditions and limitations set out in GDPR and national law:
- Right of access: the right to obtain confirmation as to whether personal data concerning you is being processed and, where that is the case, access to that personal data and related information.
- Right to rectification: the right to request correction of inaccurate personal data and completion of incomplete personal data.
- Right to erasure: the right to request deletion of personal data in certain circumstances, for example where the data is no longer necessary for the purposes for which it was collected, subject to legal or regulatory obligations requiring retention.
- Right to restriction of processing: the right to request restriction of processing in certain circumstances, for example where the accuracy of the personal data is contested or where processing is unlawful and erasure is not requested.
- Right to data portability: the right to receive personal data that you have provided in a structured, commonly used, and machine-readable format and to transmit that data to another controller, where processing is based on consent or contract and is carried out by automated means.
- Right to object: the right to object, on grounds relating to your particular situation, to processing based on legitimate interests and, in all cases, the right to object at any time to processing of personal data for direct marketing purposes.
- Right to withdraw consent: where processing is based on consent, the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Requests to exercise these rights should be submitted using the contact details in Section 9. Verified requests will be handled within the time limits set by applicable law.
In addition, data subjects have the right to lodge a complaint with the Data Protection Commission in Ireland if they consider that the processing of their personal data is in breach of GDPR or applicable data protection law.
- Contact Information
For privacy-related enquiries, requests to exercise data subject rights, or questions regarding this Privacy Policy, contact Carlton Casino Club at:
Email: [email protected]
Responses to privacy-related requests will be provided within a reasonable period and in accordance with applicable GDPR obligations.
- Cookies and Tracking Technologies
The website of Carlton Casino Club uses cookies and similar tracking technologies. These technologies are used for purposes including:
- Site functionality and user preferences
- Security and session management
- Performance measurement and analytics
Non-essential cookies are used only with your prior consent. Cookie preferences can be managed at any time using the cookie settings available on the website or through browser settings where applicable. Withdrawal of consent to non-essential cookies does not affect access to the core services but may impact certain functions or features.
- Data Security
Appropriate technical and organisational measures are implemented to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored, or otherwise processed.
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, the relevant supervisory authority will be notified without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach, in accordance with GDPR. Where the breach is likely to result in a high risk to the rights and freedoms of data subjects, affected individuals will also be informed without undue delay, in line with applicable legal requirements.
- Changes to This Privacy Policy
This Privacy Policy may be updated from time to time. The current version is made available on the website of Carlton Casino Club.
Where changes are material, users may be informed by appropriate means, which may include notifications on the website or by email, where permitted by law. Continued use of the services after publication or notification of an updated version of this Privacy Policy constitutes acknowledgement of the updated Policy.