Information about Processing Olympic Casino and OlyBet Customers’ Personal Data for Direct Marketing and Analytics Purposes

  1. The joint controllers of your personal data are OLYMPIC ENTERTAINMENT GROUP AS (registry code 14437516, address Pronksi tn 19, 10124 Tallinn, Estonia), who is the operator of Olympic Casino, and OB Holding 1 OÜ (registry code 14975047, address Pronksi tn 19, 10124 Tallinn, Estonia), who is the operator of OlyBet (together – we).
  2. We use the electronic contact details provided by you to send you information and special offers on the subjects chosen by you to promote the businesses of Olympic Casino and OlyBet. The legal basis for processing your personal data is your consent (Art 6(1)(a) of the GDPR).
  3. If you agree, the information and special offers will be personalised, i.e., sent to you based on our best understanding of your interests and behaviour. In making these offers, we may contact you based on, for example, your use of Olympic Casino and OlyBet services (e.g., if you prefer certain games in Olympic Casino, we may notify you if such games become available in OlyBet; if you have participated in certain events or offers before, offer them to you again; provide special offers to players who have staked a certain amount, etc.). The purpose is to know you better in order to incentivize you to use our services. In doing so, we use both profiling and automated decision-making. The automated decisions usually take place without human intervention. However, they do not bring about any legal effects to you or otherwise similarly significantly affect you. At worst, we may send you offers you are not interested in. The personalised offers may somewhat increase the addiction of compulsive gamblers; however, we have taken the necessary safeguards and never target any such player knowingly and strongly encourage responsible gaming. You have the right to obtain human intervention regarding the decision making, express your point of view regarding such decisions, and contest the decisions. The legal basis for processing your personal data is your consent (Art 6(1)(a) of the GDPR).
  4. We will process your personal data for the above-mentioned purposes until you withdraw your relevant consent(s), asking you to update your preferences from time to time.
  5. We also provide you information and special offers via phone or when you visit Olympic Casino or OlyBet. These offers are usually personalised, i.e., based on our best understanding of your interests and behaviour as explained above. The legal basis for processing your personal data is our legitimate interest to promote the businesses of Olympic Casino and OlyBet (Art 6(1)(f) of the GDPR). In such case, we have concluded that, considering the circumstances, our legitimate interest is not overridden by your interests or fundamental rights and freedoms which require protection of personal data. You have the right to object at any time to such processing by contacting us on the contact details below.  In such case, your personal data will no longer be processed for direct marketing purposes.
  6. We use the personal data you have provided us or that has been created based on your use of Olympic Casino and OlyBet services on an aggregated level for analytics, i.e., to understand our customers, their needs, and behaviour better in order to make better marketing and business decisions. For example, to understand which Olympic Casino games are popular and should also be available in OlyBet to increase its use; in which order the games should be listed to increase their popularity; which OlyBet sports events are popular and should be streamed in Olympic Casino; what are the characteristics of customers who are active either only or both online and offline; etc. Although such analytics may initially be based on some of your personal data, the data is aggregated, and no personal data is used in any reports. The legal basis for processing your personal data is our legitimate interest to make better marketing and business decisions and to promote the businesses of Olympic Casino and OlyBet (Art 6(1)(f) of the GDPR). In such case, we have concluded that, considering the circumstances, our legitimate interest is not overridden by your interests or fundamental rights and freedoms which require protection of personal data. You have the right to object, on grounds relating to your situation, at any time to such processing by contacting us on the contact details below. In that case, we will no longer process your personal data for analytics purposes unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms.
  7. We will process your personal data for the above-mentioned purposes until you object to it and we do not have the right to continue processing or until you have an active agreement with either of us.
  8. You have all the rights of a data subject under the GDPR, including the following:
  • The right to withdraw consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
  • The right to obtain confirmation as to whether personal data concerning you are being processed and a copy of those data.
  • The right to obtain the rectification of inaccurate personal data concerning you, including to have incomplete personal data completed.
  • The right to obtain the erasure of your personal data.
  • The right to obtain restriction of processing.
  • The right to receive your personal data, which you have provided to us, in a structured, commonly used, and machine-readable format and the right to transmit those data to another controller without hindrance from us.
  • The right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or  the Estonian Data Protection Inspectorate (www.aki.ee).

Note that not all rights listed above are absolute and may be restricted for purposes allowed under the GDPR. You can exercise some of your rights by visiting Olympic Casino reception or by logging into your OlyBet account or, in any case, by contacting us on the contact details below.

  1. Note that our other personal data processing practices are described in our respective Privacy Policies, available on our respective websites (www.olympic-casino.ee for Olympic Casino and www.olybet.ee for OlyBet). Olympic Casino’s Privacy Policy is also available at the Olympic Casino reception. Also note that the withdrawal of consent(s) for or opting out from the marketing and analytics purposes does not preclude us from processing your personal data for other purposes described in the Privacy Policies.
  2. Contact details for inquiries: Data Protection Officer Aare Reinsalu aare.reinsalu@oc.eu and Markus Malm markus.malm@oc.eu. 

Information about processing the personal data for casino customers

Confirmed: 09.08.2021

  1. Personal data is processed by Olympic Entertainment Group AS (hereinafter the company) at Pronksi 19, Tallinn 10124, Estonia, +3726671250, estonia@oc.eu.
  2. To contact the company’s data protection officer, an e-mail has to be sent to DataProtectionOfficerEstonia@oc.eu or call the company’s general phone number +3726671250.

  3. The Customer has the right to receive information about whether the company processes their personal data and, if the company does, to obtain a copy of the data

  1. The  Customer has the right to demand the amendment of inaccurate personal data.

  1. The Customer has the right to withdraw their consent at any time if the data processing is based on consent. The withdrawal of consent does not affect the lawfulness of data processing prior to the withdrawalt. 

  1. The Customer has the right to withdraw from the direct marketing data processing at any time. The withdrawal of consent does not affect the lawfulness of data processing prior to the withdrawal

  1. The Customer has the right to request the deletion of their personal data. The company has no absolute obligation to delete the data. The company can delete data that is processed based on consent or legitimate interest, unless the interest of the Company is outweighed by the interest of the Customer. The right to erase does not apply to data processed due to legal obligations or under contract when they are in force

  1. The Customer has the right to object to the processing of their personal data, particularly if it is in their legitimate interest, and to restrict the processing of their personal data if this is justified

  1. The customer has the right to receive their personal data, which they have provided themselves in a structured and machine-readable form (where technically possible) for the transmission to another service provider

  1. In the course of data processing the customer data will be shared with third parties if this is necessary for the performance of obligations arising from legislation or contracts. The recipients of the data are governmental supervisory authorities and service providers, such as the mediator of the PEP check and the sanction control database, the provider of software for managing the poker tournament, the service provider for sending the e-mails and messages, the service provider for the registry of customer feedbacks, or the online survey service provider 

  1. To provide the service, the company can share customers’ data with other Companies of the Olympic Entertainment Group 

  1. The Customer has the right to submit a complaint about the use of data to the Data Protection Inspectorate of the Republic of Estonia by sending an e-mail to info@aki.ee or by going in-person to visit Tatari 39, 10134, Tallinn

  1. Descriptions of the processing of personal data:

    13.1    Verification of client’s personal data from the Tax and Customs Board Register of Self-Exclusion 
    The basis for the processing: Gambling Act § 39 (8
    If personal data is not provided, the customer will not be allowed to enter the game area or participate in the gaming 
    Data retention: Queried data is not retained 

    13.2    Check the customer’s casino ban from the company’s casino ban registry 
    The basis for processing: Gambling Act § 33(1) and § 35 (4
    If personal data is not provided, the customer will not be allowed to enter the game area or participate in the gaming 
    Data retention: 5 years from the customer’s last visit 

    13.3    Registration of customer’s personal data upon entering the casino 
    The basis for processing: Gambling Act § 37 (8
    If personal data is not provided, the customer will not be allowed to enter the game area or participate in the gaming 
    Data retention: 5 years from the customer’s last visit 

    13.4    Registration of the customer’s country of residence upon entering the casino  
    The basis for processing: Money Laundering and Terrorist Financing Prevention Act § 36 (2) 4
    Data retention: 5 years from the customer’s last visit 

    13.5    Registration of additional customer personal data, such as gender and language
    The basis for processing: Legitimate interest  
    Data retention: 5 years from the customer’s last visit 

    13.6    Adding customer’s photo to a customer’s  account
    The basis for processing: Legitimate interest  
    Data retention: 5 years from the customer’s last visit

    13.7    Identification and registration of politically exposed persons 
    The basis for processing: Money Laundering and Terrorist Financing Prevention Act § 20 (1) 5
    Data retention: 5 years from the customer’s last visit 

    13.8    Receiving and sending the customer’s application for the self-exclusion to the Tax and Customs Board 
    TThe basis for processing: Gambling Act § 39 (3) to (5
    The company refuses to accept the application if the customer fails to provide personal data
    Data retention: After the transaction is completed, the data will be deleted 

    13.9    Checking and analyzing the customer’s background information  
    The basis for processing: Money Laundering and Terrorist Financing Prevention Act § 20 (1
    Data retention: 5 years from the customer’s last visit 

    13.10    Registration of transactions starting from 2000€  
    The basis for processing: Money Laundering and Terrorist Financing Prevention Act § 19 (3) 
    If personal data is not provided, the customer will not be allowed to participate in the gaming and the company can deny from payouts 
    Data retention: 5 years from the customer’s last visit

    13.11    Reporting the cash transactions beginning 32 000€ to the transactions to the FIU
    The basis for processing: Money Laundering and Terrorist Financing Prevention Act §49 (3)
    If personal data is not provided, the customer will not be allowed to participate in the gaming and the company can deny or refuse payouts
    Data retention: 5 years from the customer’s last visit

    13.12    Surveillance cameras recordings to evaluate security in casinos 
    The basis for processing: Gambling Act § 37 (14
    Data retention: 30 days 

    13.13    Compiling security reviews based on camera informatipn 
    The basis for processing: Gambling Act § 33 (1) 1
    Data retention: 3 years

    13.14    Surveillance cameras recordings to evaluate service in casinos 
    The basis for processing: Legitimate interest  
    Data retention: 30 days 

    13.15    Compiling service overview based on the camera information 
    The basis for processing: Legitimate interest 
    Data retention: 3 years

    13.16    Registration of incidents regarding customers in the casino 
    The basis for processing: Gambling Act § 33 (1) 1
    Data retention: 5 years from the customer’s last visit

    13.17    Issuing an Olympic Casino club card 
    The basis for processing: Club card agreement
    Failure to provide personal data will result in the Club card not being issued 
    Data retention: 5 years from the customer’s last visit

    13.18    Dentification of the client when performing bank card transactions without a pin code at the payment terminal  
    The basis for processing: Money Laundering and Terrorist Financing Prevention Act § 19 (3), § 20 (1) 4), (2) and (3
    Failure to provide personal data, no transaction will occur 
    Data retention: Personal data will not be retained 

    13.19    Earning bonus points to club card when playing in casino 
    The basis for processing: Club card agreement 
    Data retention: 5 years from the customer’s last visit 

    13.20    Earning award points to the Club Card from the gaming or from marketing campaigns 
    The basis for processing: Club card agreement 
    Data retention: 5 years from the customer’s last visit 

    13.21    Exchange of bonus points for cash or gaming equipment 
    The basis for processing: Club card agreement
    Data retention: 5 years from the customer’s last visit  

    13.22    Analysis of the turnover bonus points to determine the Customer Club level 
    TThe basis for processing: Club card agreement
    Data retention: 5 years from the customer’s last visit 

    13.23    Pay for bar products with bonus points or compliment points 
    The basis for processing: Club card agreement
    Data retention: 5 years from the customer’s last visit  

    13.24    Discount calculation for bar products for Club card holders 
    The basis for processing: Club card agreement 
    Data retention: 5 years from the customer’s last visit 

    13.25    Giving gifts to customers 
    The basis for processing: Legitimate interest
    Data retention: 5 years from the customer’s last visit 

    13.26    Issuing the gaming winnings certificate 
    The basis for processing: Customer’s  consent
    Data retention: 7 years

    13.27    Gaming winnings transfer to customer’s bank account
    The basis for processing: Customer’s  consent
    Data retention: 7 years

    13.28    Participation in a paper ticket-based marketing campaign
    The basis for processing: Customer’s  consent
    Data retention: 3 months after the end of the campaign

    13.29    Winning the paper ticket-based marketin campaing
    The basis for processing: Customer’s  consent 
    Data retention: 7 years 

    13.30   Customer authorization for another person to participate in a marketing campaign raffle 
    The basis for processing: Customer’s  consent
    Data retention: 1 year 

    13.31    Gather contacts from potential customers at publicevents
    The basis for processing: Customer’s  consent
    Data retention: Until the customer’s consent is withdrawn

    13.32    Sending marketing information about gambling to a customer by e-mail or SMS
    The basis for processing: Customer’s  consent
    Data retention: 1 year 

    13.33    Poker cash game waiting list registration
    The basis for processing: For performance of the contract
    Data retention: 1 month

    13.34    Manage poker tournament participants
    The basis for processing: For performance of the contract
    Data retention: 10 years

    13.35    Recording and ranking of tournament poker results 
    The basis for processing: Legitimate interest
    Data retention: Data will not be deleted

    13.36    Buying and using the Casino Entertainment Package 
    The basis for processing: Purchase and Sales Agreement
    Data retention: 5 years from the last visit of the customer

    13.37    Submitting, registering and handling of customer  
    The basis for processing: Gambling Act § 35 (5
    The company does not have the opportunity to respond to feedback if personal data is not provided
    Data retention: 1 year 

    13.38    Conducting a customer satisfaction survey using a web application
    The basis for processing: Consent of the data subject  
    Data retention: Data will be deleted at the end of usage

    13.39    Accounting of the customer debts caused by ruining/destroying company property 
    The basis for processing: Instalments to be paid for damages according to the contract 
    Data retention: 7 years

    13.40    Processing customer personal data in OEG data base for direct marketing offers
    The basis for processing: Legitimate interest  
    Data retention: 5 years from the customer’s last visit

    13.41    Information and analysis of big winnings
    The basis for processing: Legitimate interest
    Data retention: Data will not be deleted

    13.42    Registering customer sports bets 
    The basis for processing: Legitimate interest
    Data retention: 5 years from the customer’s last visit

    13.43    Transfer a video image of park casino roulette game area to a partner of the streaming service
    The basis for processing: Legitimate interest
    Data retention: Data is not retained

          13.44 COVID certificate checking
          The basis for processing: Regulation nr 282 of the Government of the Republic „Measures and restrictions necessary to prevent the spread of COVID-19“ point 20’18 3)
          Data retention: Data is not retained

          13.45    COVID certificate storing in customer profile
          The basis for processing: Customer’s consent
          Data retention: 5 years from the customer’s last visit