Privacy Policy
1. Scope and Application
This Privacy Policy (the “Policy”) explains how Golden Roo handles information and Personal Data that you supply or that we collect, allowing us to manage our relationship with you effectively.
The Policy covers our websites, applications, products, and services that refer to it or do not provide a separate privacy policy. Together, these are referred to as our services.
Its purpose is to explain what information we collect, why we need it, how we process it, and with whom it may be shared. It also describes your rights concerning the collection, processing, and disclosure of your information, together with other relevant privacy and security matters.
References to the “Company”, “we”, “us”, and “our”, including grammatical variations, mean the Data Controller described in this Policy.
Reading this Policy means that you understand and acknowledge the ways in which your Personal Data may be processed. If you do not accept its terms, please refrain from using the Website or supplying us with Personal Information.
1.1. Applicable Data Protection Laws
The Company’s processing described here will comply with the National Ordinance on the Protection of Personal Data (the “DPA”), any subsidiary legislation made under it, and amendments to either from time to time.
It will also comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 concerning the protection of natural persons in relation to Personal Data processing and the free movement of those data, repealing Directive 95/46/EC, known as the General Data Protection Regulation (the “Regulation” or “GDPR”).
The DPA and GDPR are collectively called the “Data Protection Laws”. Because the Company decides the purposes and means of processing Personal Data, it acts as the Data Controller under those laws.
2. Definitions
2.1. Data Controller
A Data Controller is a natural or legal person, public authority, agency, or other body that determines, either independently or jointly, why and how Personal Data are processed. Where Union or Member State law determines those purposes and means, that law may designate the controller or set the specific criteria for its appointment.
2.2. Data Processor
A Data Processor is a natural or legal person, public authority, agency, or other body that processes Personal Data for the controller.
2.3. Personal Data
Personal Data are information that identifies you individually or concerns an identified or identifiable natural person, also known as a data subject.
3. Security Measures
The Company uses the secure internet communication protocol TLS 1.2 to protect remittances. This protocol encrypts your Personal Data while they are transmitted online. Digital records are also kept on encrypted hard drives, providing an additional security safeguard.
Our services are registered with website identification authorities so that your browser can verify our identity before sending personally identifiable information. Advanced firewall technology on our secure servers provides further protection.
4. Protection of Personal Data
We safeguard the Personal Data in our possession through security systems and procedures meeting the highest industry standards. Our commitment involves both maintaining high-quality protection and applying the law effectively. Processing must have a genuine, legitimate reason supported by one of the legal grounds established in the GDPR.
5. Processing for Legitimate Interests
We have a legitimate interest where a business or commercial reason supports the processing of Personal Data. When relying on this ground, we undertake to protect your information and its handling, and to ensure that processing is not unfair to you or your interests.
If we choose to rely on legitimate interests, we will explain that choice, identify those interests, and provide a way for you to ask questions or object. An objection does not require us to stop processing where our grounds override your right to object. This may apply, for example, when processing is needed for anti-money laundering purposes. It also applies to compliance with binding requirements of Curacao law, since operating lawfully is a legitimate interest of the Company.
6. Processing Based on Consent
Consent is one of several grounds on which we may be entitled or required to process your information. We rely on consent only when another ground, such as a legal obligation or legitimate interest, cannot be used or we choose not to use it.
You may withdraw consent at any time through the same method by which you gave it. If you do, we will assess whether another legal ground allows or requires continued processing and will notify you if it does. Withdrawal does not invalidate processing performed before consent was withdrawn.
7. Retention of Information
7.1. Retention Principles
All Personal Data retained by the Company will receive the best protection possible and will be used only for purposes consistent with Data Protection Laws and other applicable legislation. We keep information only as long as necessary, considering the original reason for collection. What is necessary depends on the information concerned and the nature and duration of our relationship with you.
7.2. Statutory Retention Periods
Our usual practice is to check whether a specific law, such as tax or company legislation, permits or requires retention for a defined period. Where it does, we retain the information for the maximum period specified by that law. For example, information classified as transactional data must be kept for at least five (5) years.
7.3. Information Needed for Claims
We also consider whether you or a third party could invoke legal or contractual provisions against us, and the applicable limitation periods, which are usually five (5) years. Relevant information that may be required to defend claims, challenges, or similar actions will be retained for as long as necessary.
7.4. Deletion and Missing Information
When we no longer need Personal Data, we will securely delete them or make them anonymous.
If you do not supply necessary information, we may be unable to meet legal, regulatory, or contractual duties or carry out the services required to administer and maintain your account properly. As a result, certain products or services may be unavailable to you.
8. Information We Collect and Why We Process It
The categories, purposes, and legal grounds below describe our processing activities. The same category of information may serve more than one purpose and therefore be processed under different legal grounds.
8.1. Contact Information
Contact data may include your first and last names, residential mailing address and postcode, telephone or mobile number, email address, and a recent utility bill showing where you live.
8.2. Identity Information
Identity data may include your first and last names, address, date of birth, identity card or passport number, photograph, gender, occupation, marital status, family information, and hobbies.
8.3. Activity Information
Activity data cover Website logins, activity, and transactions. Examples include bets placed, winnings and bonuses received, account payments and withdrawals, analytics, parts of your browsing history, preferred bet types or games, time spent on individual pages, clicks, actions, and cookies. This category also includes communications with Customer Service by telephone, email, or live chat, and whether you have self-excluded from our services.
8.4. Technical Information
Technical data include traffic information, GeoIP location, and information obtained from your browser, computer, or mobile device when you access or use the services, including device and network details.
8.5. Financial Information
Financial data include currency, credit card and banking information, other payment details, and the source of funds.
8.6. Marketing and Educational Information
Information used for marketing and education may include your first and last names, mailing address, telephone or mobile number, email address, evidence of opt-in consent where required, and records of objections to marketing. It may also include Website data and online identifiers, such as your IP address and other browser-generated information.
9. Purposes of Processing
9.1. Registration and Identity Checks
We process information to create a system record, register you as a new customer, confirm your identity, and prevent possible fraud, including third parties using your details to impersonate you.
9.2. Protection of Personal and Credit Information
Processing helps us provide additional security for your personal and credit information and for the use of your credit card.
9.3. Gambling-Related Support
We use information to provide support and protection in relation to gambling addiction problems.
9.4. Account Relationship and Services
Information allows us to oversee and manage our continuing relationship, deliver sports betting and casino games, and provide our full range of customer care services.
9.5. Subscriptions
Processing enables subscriptions to newsletters and campaigns and inclusion on mailing lists.
9.6. Customer Experience and Enquiries
We use data to provide information about your profile and requests, personalise your experience, and maintain a responsible gaming environment. We also keep current information about earlier queries, complaints, and questions to improve our service.
9.7. Payment Monitoring
We monitor deposits and withdrawals to prevent unlawful use by third parties.
9.8. Marketing and Educational Communications
Information is used to deliver marketing you have requested or that we are otherwise authorised to send. We also provide educational materials, notices of upcoming events, and related information that may assist you in connection with the services received or for educational purposes.
10. Legal Grounds and Additional Processing
10.1. Grounds Relied Upon
Our processing grounds include contractual necessity; legitimate interests; gambling licence requirements; anti-money laundering and KYC regulations; your consent where required or for direct marketing; and Responsible Gaming regulations.
Our legitimate interests include keeping accurate system records, supplying information you request, and continually developing and delivering innovative betting and gaming experiences.
10.2. Publicly Available Information
The Company may obtain Personal Data through public sources, including internet searches, company registers, and broadcast media, where doing so is reasonable and does not prejudice your rights and freedoms.
10.3. Profiling and Human Decisions
Some information is used for checks that contribute to account profiling. Profiling involves automated processing of Personal Data to meet AML directives and prevent other fraudulent activity involving your details, such as tax evasion or suspicious betting patterns.
No decisions, including marketing decisions, are made automatically. Although the system may automatically verify details such as IP addresses or perform PEP checks, our staff make the final decision in every case. Your email address is also checked, and you will receive an email asking you to confirm it.
11. Further Information About Consent
In the limited situations where we cannot or choose not to rely on another legal ground, including legitimate interests, we process Personal Data on the basis of consent. Consent is never assumed: it must be obtained from you clearly and expressly.
YOU MAY WITHDRAW YOUR CONSENT AT ANY TIME, using the same method by which it was supplied. You may also exercise this right by writing to the physical or email address referred to below. Following withdrawal, we will examine whether another legal basis, such as a binding legal obligation, permits or requires processing without consent, and notify you if that is the case.
You may refuse to supply requested Personal Data. However, if those data are necessary for the services you request, refusal may prevent us from providing them, particularly where consent is the only available legal ground. Consent is not our sole processing ground; the other grounds are described above.
12. Cookies and Similar Technologies
Visiting the Site results in the automatic collection of certain Personal Data through cookies and comparable technologies. A cookie is placed on your computer when you use the Website. These technologies generally assign a unique number to your browser or device that has no meaning outside our Site.
We use them to tailor your experience, including language and currency preferences, and to display content relevant to your interests. After you enter your email address and password during a session, we retain that information so that repeated entry is unnecessary during that session. With your agreement, this may extend to automatic sign-ins in the future.
Most browsers accept cookies automatically. Browser or mobile-device settings allow you to manage information collection through cookies and equivalent tools. We are committed to giving you choices over privacy and sharing.
We do not recognise or respond to browser-generated Do Not Track signals because the internet industry has not fully established the relevant standards, implementations, and solutions.
Rejecting cookies may prevent you from using some Website features. Your IP address may also be used to identify you, administer the Website, and help diagnose server problems.
13. Other Processing Purposes
In accordance with our legitimate interests, we may need to use and retain personal information to prevent losses and safeguard our rights, privacy, safety, or property, or those of other people.
14. Authorised Third-Party Disclosures
Without limiting other provisions of this Policy, information about you may be disclosed to authorised third parties or competent authorities inside or outside the EU/EEA where Data Protection Laws or other applicable legislation permit or require it.
Recipients may include Company entities, other organisations and third parties, law enforcement bodies, accounting and auditing firms working with us, regulators, relevant authorities, and digital marketing providers. We may also disclose information to organisations that introduced you to us, parties you have asked or allowed us to share with, or parties whose involvement is necessary to supply your requested products or services. The information disclosed depends on the products or services you use.
Where information leaves the European Economic Area (EEA), all necessary and appropriate safeguards will be in place. Information may also be supplied to associated or subsidiary companies, business partners, or successors in title to our business. Section 19 explains transfers outside the EEA in more detail.
Your Personal Data will not be supplied to third parties for their own marketing unless you consent.
15. Other Categories of Recipients
Where appropriate and lawful under Data Protection Laws, relevant information may be shared with Company members and staff, other Company entities, affiliated entities, or subcontractors for the purposes described in this Policy. This includes disclosures within the Company to meet legal obligations and disclosures to providers supporting the Site’s operation or a service you require.
We share personal information only to supply requested services or for another lawful reason, including authorised disclosures that do not require consent.
All such disclosures follow Data Protection Laws. Our processors are contractually required to comply with those laws, maintain strict confidentiality, and place equivalent confidentiality duties on their personnel. Service providers acting as processors must also meet further obligations, particularly those in Article 28 of the GDPR.
We will never allow third parties to receive your Personal Data for their own marketing purposes without your consent.
16. Internet Communications
Information sent online can cross national borders even if both sender and recipient are in the same country. We are not responsible for actions or omissions by you or a third party before Personal Data reach us. This includes transfers passing through a country with lower data protection standards than the European Union, regardless of the technology used, such as WhatsApp, Skype, or Dropbox.
We accept no responsibility or liability for information security during internet transmission unless a law effective in Curacao expressly imposes that responsibility on us.
17. Keeping Information Accurate
We take reasonable steps to maintain accurate and current Personal Data. You may contact us using the method described below at any time to check the information held about you. Any inaccuracies you identify will be corrected at your request. Section 20 provides further details of your legal data protection rights.
18. External Website Links
Links to third-party websites are clearly identified. We neither endorse nor accept responsibility for their content, including privacy notices and any data processing they perform. We recommend reviewing the privacy policies on those websites.
19. Transfers Beyond the EEA
Protecting your information is a priority. Appropriate technical and organisational safeguards are in place, and all Personal Data are held on secure servers operated by reputable, certified providers.
Most storage and processing take place in the EEA. However, third parties with whom we share information as described above may access or store it, and some may act as sub-processors outside the EEA. Our own staff or agents working outside the EEA may also access and process your information.
For these transfers, we ensure appropriate safeguards, enforceable data subject rights, and effective legal remedies through standard contractual clauses and/or other suitable legal grounds. Copies of the safeguards can be requested through LiveChat. All processors are contractually required to follow strict security standards offering the same level of Personal Data protection as within the EEA.
Accepting this Policy constitutes your specific agreement and opt-in to the international transfers described here.
20. Your Rights as a Data Subject
We undertake to assist you as fully as possible when you exercise rights relating to your Personal Data. Identity verification may be required before some requests can be processed.
20.1. Access
On request, we will confirm whether we process information about you. Where we do, you may access it and obtain information about the data held, the reasons for processing, recipients, intended retention periods where possible, and any international transfers and safeguards.
You may also obtain details of your rights, how to complain, the source of your information, and whether automated decision-making, including profiling, has taken place, together with related information.
20.2. Rectification
You may ask us to correct inaccurate information about you or complete information that is incomplete.
20.3. Erasure
You may request deletion under the “right to be forgotten”. We will act without undue delay where the information is no longer needed for its original purpose; consent has been withdrawn and no other processing ground remains; you have successfully objected; processing was unlawful; a legal obligation requires deletion; or special circumstances involving certain children’s rights apply.
We are not legally required to grant erasure if continued processing is necessary to fulfil a legal obligation imposed on us.
20.4. Restriction of Processing
You may seek restriction where you dispute accuracy, for the period needed to verify the information; processing is unlawful but you oppose deletion; we no longer need the information for its original purpose but you need it to establish, exercise, or defend legal claims; or you have objected and verification of whether our legitimate grounds override that objection is pending.
If restriction is granted, we may process the information only with your consent; to establish, exercise, or defend legal claims; where we no longer require it for the purposes of collection; to protect another natural or legal person’s rights; or for important public interest reasons.
20.5. Data Portability
You may request the Personal Data you previously supplied in a structured, commonly used, machine-readable format. Where technically possible, we may send them directly to another Data Controller, provided others’ rights and freedoms are not adversely affected. This right applies only when processing is based on consent or performance of a contract with you and is carried out by automated means.
20.6. Withdrawal of Consent
You may withdraw consent whenever you wish. Section 11, “Further Information About Consent”, explains this right in more detail.
20.7. Objection to Processing
In certain circumstances, you may object where processing is necessary for a task performed in the public interest or for legitimate interests pursued by us or a third party. For legitimate-interest processing, we will stop only if the Data Controller has not demonstrated compelling legitimate grounds that outweigh your objection and require continued processing.
You may object at any time to the use of your information for direct marketing. Outside the circumstances described above, this general right to object does not apply.
20.8. Complaints and Refusal of Requests
If you believe the Company has infringed your rights, you may complain at any time to a relevant Data Protection Supervisory Authority. We nevertheless ask that you first try to resolve your concern with us.
Despite these rights, we may refuse a request where that decision can reasonably be justified. Such refusal does not remove your right to complain to the relevant data protection authority.