Privacy Statement

Casinos Austria Aktiengesellschaft (hereinafter “Casinos Austria”), Österreichische Lotterien Gesellschaft m.b.H. (hereinafter “Austrian Lotteries”) with its online gaming platform (hereinafter “win2day”), Glücks- und Unterhaltungsspiel Betriebsges.m.b.H. (hereinafter “WINWIN”) and Österreichische Sportwetten Gesellschaft m.b.H. (hereinafter “Austrian Sports Betting Company”) – all of these companies hereinafter referred to collectively as “we” or “us” – are pleased you are visiting this website.

The Federal Minister of Finance may transfer by means of a licence the right to operate lotteries pursuant to Sec. 14 of the Austrian Gaming Act (Glücksspielgesetz, GSpG) and the right to operate a casino pursuant to Sec. 21 of the Austrian Gaming Act.

Casinos Austria holds twelve casino licences in Austria and operates casinos at locations in Baden, Bregenz, Graz, Innsbruck, Kitzbühel, Kleinwalsertal, Linz, Salzburg, Seefeld, Velden, Vienna, and Zell am See. Austrian Lotteries holds the licences to operate specific lotteries such as Lotto “6 of 45”, the Toto football pool, instant lotteries such as the scratch-off and break-open tickets, the Class Lottery, Number Lotto “1-90”, electronic lotteries (“win2day” online games), games on video lottery terminals (“WINWIN” VLT locations), Bingo, Keno as well as add-on games with multiple draws.

The Austrian Sports Betting Company offers betting, sports betting in particular, pursuant to notices based on the respective provincial regulations governing bookmakers and totalisators.

The current version of the Austrian Gaming Act and the provincial regulations governing bookmakers and totalisators can be accessed and examined via the Legal Information System of the Republic of Austria at www.ris.bka.gv.at/defaultEn.aspx.

In this privacy statement you will learn which personal data we process by automated means, in what way and for what purpose, on our websites and apps, and in the context of the provision of our services, which we provide on the basis of the licences and authorisations granted to us. In addition, we hereby inform you of your rights as a data subject of the data processing.

We request that you read this privacy statement carefully. By using our products and services which result in transfer of your personal data to us, you declare that

you have been informed of the use of your personal data pursuant to this privacy statement.

The protection of your personal data is especially important to us. If you do not agree to the use of your personal data within the scope of this privacy statement as it applies to you, please do not make your personal data available to us. In this case, you will not have access to those products and services whose use requires the processing of your personal data (e.g. use of customer loyalty programmes or use of discount campaigns or event offers tailored to you).

Your point of contact for data processing is our

Data Protection Officer

Email address: datenschutz@cal.at

Telephone: + 43 1 534 40 50

Within the meaning of the data protection regulations, the following companies (collectively referred to as the “corporate group”) act as data processing controllers or, where applicable, as processors, within the scope of our products and services:

Casinos Austria Aktiengesellschaft

FN 99639d

Österreichische Lotterien Gesellschaft m.b.H.

FN 54472g

Glücks- und Unterhaltungsspiel Betriebsges.m.b.H.

FN 241637z

Casinos Austria International Holding GmbH

FN 37681p

Österreichische Sportwetten Gesellschaft m.b.H.

FN 196645i

Cuisino Ges.m.b.H. (hereinafter “Cuisino”)

FN 54015i

CAST Casinos Austria Sicherheitstechnologie GmbH

FN 94404f

Österreichische Klassenlotterie Vertriebsgesellschaft m.b.H.

FN 468412t

All of these companies have their registered offices at:

Rennweg 44

1038 Vienna

Congress Center Baden Betriebsgesellschaft m.b.H. (hereinafter “CCB GmbH”)

FN 67046y

Kaiser Franz Ring 1

2500 Baden

 

Processors are commissioned by us to process your data for us within the scope prescribed by law for this purpose. This applies to data processing both by the above-mentioned companies within our corporate group and by processors outside the corporate group.

External processors only receive your data if it is necessary, e.g. to perform a contract, to process your order or for a prize draw.

As a basic principle, we only use processors outside the European Union if (i) there is an adequacy decision of the European Commission for the third-party country in question, or (ii) we apply the standard contractual clauses of the European Commission, or iii) there are appropriate guarantees with the third-party country or (iv) we have agreed binding internal data privacy rules with the processor.

As our organisational structure is that of a corporate group, in addition to data processing on behalf of the individual companies within our corporate group, data may also be processed by joint controllers. For this reason, in addition to a Commissioned Data Processing Agreement, a Joint Controller Agreement has been concluded, the main content of which is set out below. We comply with our information obligations under data protection law by means of this privacy statement.

The Controllers are jointly required to ensure that the technical and organisational measures necessary for legally compliant data processing and for the protection of the rights of data subjects are implemented; these measures also ensure the security of processing as required by law within the meaning of Art. 32 of the General Data Protection Regulation (Datenschutz-Grundverordnung, DSGVO). Each joint controller is required to ensure that its employees observe confidentiality and act in accordance with the rights and obligations set out in the Joint Controller Agreement. The controller that is closest (under the internal organisational structure) to the data processing in question is required to satisfy legal reporting, notification, consultation and assessment obligations. In case of doubt, the duties shall be fulfilled jointly.

Requests from data subjects in connection with the exercise of data subject rights may, in the case of data processing with joint controllers, be assigned to any controller. Requests must be processed and answered by the controller to which they are addressed, or they may be forwarded for processing and answering to the controller which is mainly concerned with the content of the request. That controller must ensure that the data subjects’ rights are being complied with.

Your data will otherwise be transferred to third parties only if you have expressly consented in advance to your data being forwarded, if we have a legal obligation to transfer the data, if the data transfer is necessary for performing the contractual relationship or if there are sufficient legitimate interests for transferring the data. Your personal data will not be sold to third parties or otherwise marketed.

Facebook fan page

In the course of running a Facebook fan page, data is processed by joint controllers, i.e. by the respective company within our corporate group that operates the page and by Facebook.

Information concerning data processing which is carried out in the course of running a Facebook fan page can be found here. The corresponding Data Processing Agreement can also be viewed via this information page.

Data may be transferred to subsequent recipients (groups of recipients), for example in the context of performing contracts or legal obligations or in the pursuit of legitimate interests. These are the data controllers or processors. For further details on recipients, please refer to the chapter on data controllers and processors and subsequent chapters.

· Legal counsel

· Courts and other public authorities

· Banks

· Credit agencies

· Betting offices/acceptance points and payment offices

· Other counterparties or business associates

Personal data means any information relating to an identified or identifiable natural person. Below you will find examples of personal data that we collect and process within the scope of your use of our products and services, provided there is a legal basis for doing so:

· Name

· Title

· Date of birth

· Nationality

· Contact address(es) (e.g. email addresses)

· Telephone number, fax number

· Company information

· Administrative user data (e.g. account data, username, login ID, password)

· Employer

· Official photo ID data (e.g. personal ID card number, passport number, driving licence number, personal master data, ID card scan)

· Credit card number and data, bank details

· Cookies, IP addresses

· Location data

· Biometric data (photo)

· Visiting and gaming data

· Interests (e.g. gaming offers, events, hobbies, leisure time, sports, cultural and culinary preferences)

· Income and/or financial circumstances, credit ratings, insolvency data

Note: Not all of the examples shown here are processed by all companies of our corporate group.

We collect and process personal data only to the extent permitted by law. This is the case,

for example, if you have given your consent to the processing of personal data concerning you for one or more specific purposes. The processing of your personal data may also be necessary for the performance of a contract or for the fulfilment of a legal obligation imposed on us.

We process your data if you have provided it voluntarily, for example, if you register for one of our online products or in a casino or VLT location, order something in the online shop or through our customer service centre, participate in a prize draw or contact us by other means.

We use the personal data provided by you only to the extent that your data is necessary for the fulfilment of the specific purpose (e.g. for performance of a contract, fulfilment of a legal obligation, registration for one of our online products, sending out newsletters, processing an order in the online shop, sending out information and advertising material, running a prize draw, conducting customer analyses, market research and opinion polls, to answer a question you ask us, or to enable access to certain other information).

We collect and process your personal data for products and services of the corporate group, which you can use independently of one another.

Commissioned data processing or data processing under joint controllers by one or more companies of our corporate group is attributable, in particular, to its structure and segmentation into business units and corporate functions and is governed by contracts.

We implement technical and organisational security measures to protect your data against manipulation, loss, destruction and access by third parties. Our security measures are constantly improved in line with technological developments.

We undergo annual certification in accordance with the GoodPriv@cy international data protection seal of quality, which assists us in reviewing our strict data protection policy and assists us in continually improving it.

All information that we receive from you, such as your name, address, telephone number, email address, account information or credit card number, is transmitted and protected between your browser and our central server via SSL (Secure Socket Layer). The security server software encrypts all information provided by you before it is transmitted to us. This prevents unauthorised persons from reading, modifying, interpreting or copying this information during data transfer and subsequently forwarding it.

In addition to the general data protection regulations, our corporate group is subject, in particular, to the provisions of Sec. 51 of the Austrian Gaming Act, which deals with game secrecy. This provision specifies that organisers of games of chance which are covered by the gaming monopoly, the members of their constitutive bodies, employees, contractors and other persons working for such organisers are required to preserve confidentiality (game secrecy) regarding the identity of gamers and their participation in games of chance (winnings and losses). Exceptions to game secrecy are exhaustively covered by this statutory provision and relate, for example, to duties of information to public authorities and courts or to express waivers of game secrecy by the gamer. Because

the preservation of game secrecy is a prerequisite for maintaining the right to operate games of chance, we preserve strict confidentiality regarding your participation in such games and the winnings or losses generated.

Based on the provisions of the Austrian Gaming Act, in certain cases we have a duty to record your conduct during visits and to observe your gaming behaviour and, where necessary, to initiate measures for your own protection.

For more information regarding player protection and responsible gaming, please visit www.playsponsible.at.

In certain legally regulated cases, Casinos Austria and WINWIN are required to review your credit standing on the basis of documents, data or information obtained from a credible and independent source. By carrying out these credit checks, we comply with the legal obligations imposed on us. In addition, the credit checks serve to protect gamers and are therefore in the interest of your own safety.

To carry out credit checks, we transfer the personal data required (e.g. name, address, date of birth) to the following credit agencies:

Bisnode Austria Holding GmbH

Geiselbergstraße 17-19

1110 Vienna

CRIF GmbH

Diefenbachgasse 35-39

1150 Vienna

Kreditschutzverband 1870

Wagenseilgasse 7

1120 Vienna

These credit agencies use the personal data transmitted by us in order to make appropriate assessments of your credit rating, based on mathematical and statistical procedures (scoring).

In light of our legal mandate, we have a legitimate interest in obtaining information on insolvencies (personal bankruptcies and company insolvencies) in order to take necessary measures to protect gamers. For this reason, based on a contractual relationship with the Austrian creditor protection association Kreditschutzverband 1870, information on insolvencies (pr

us via an insolvency database.

Based on the provisions of the Financial Markets Anti-Money Laundering Act (Finanzmarkt-Geldwäschegesetz, FM-GwG) and the Austrian Gaming Act, we have a duty throughout our corporate group to compare your personal data with the Dow Jones Risk and Compliance Database at www.dowjones.com/ if you register as a player with our online products, visit a Casinos Austria casino or a VLT location or draw winnings of a certain amount. In addition, in certain cases the Financial Markets Anti-Money Laundering Act provides for the collection of information on contracting relationships and on the origins of the funds used and on your income and financial position.

Our corporate group offers you the option, via www.bkms-system.net/cal, of using a whistleblower system to report irregularities within our corporate group to top-level corporate management. As a corporate group, we have an overriding legitimate interest in learning of such irregularities. Communications between you and us are facilitated by an application service provider, enabling you to submit and us to receive, process and respond to notifications (which can be made either on an anonymous or a non-anonymous basis) using a special, secure server. Business Keeper AG (“BKAG”) has developed this whistleblower system and works for us within the scope of the data protection requirements. Data processing by BKAG takes place exclusively in the territory of the Federal Republic of Germany. BKAG has no access whatsoever to the contents of messages exchanged through the whistleblower system. The data and messages which are entered by the whistleblower are stored for purposes of processing only for so long as is necessary until processing of the whistleblower notification is complete. Where, as a whistleblower, you have not entered any personal data, the whistleblower system preserves your anonymity by means of appropriate technical and organisational measures. What this means is that whistleblowers may provide information without having to provide any personal identification details but at the same time have the option to provide information on a non-anonymous basis so that a reference to the individual may be established.

Outdoor building areas in which we operate to provide services are video-monitored and display notices to that effect. The purpose of the video-monitoring is to protect persons, such as our employees, our property and other company items and assets, and to support and safeguard work processes, such as processing deliveries, and other tasks performed in and around the building being monitored. The legal basis for this is, as a general principle, the legitimate interest in the protection of persons, property and rights. In individual cases, however, the legality of video monitoring may also derive from consent, or it may be necessary for the performance of a contract or the fulfilment of a legal obligation. These legal bases may, in individual cases, result in data being transferred to third parties, such as courts, authorities, insurance companies or victims of criminal offences. The duration of storage for video recordings is generally 72 hours. However,

in individual cases, for example due to prejudice to our legitimate interests and enforcement of related legal claims, a longer duration of storage may be required.

In order to comply with legal requirements and for your own protection, the gaming operations at the casinos of Casinos Austria and the Austrian Lotteries VLT locations are video-monitored in accordance with relevant data protection rules.

In principle, it is possible to use our websites (casinos.at, shop.casinos.at, casinosaustriainternational.com, lotterien.at, win2day.at, tipp3.at, oeswe.at, bgs.at, winwin.at) and our apps (win2day: the Casino, Lotto, Wetten app, the Lotteries Shaker app, the win2day Poker – Texas Hold ’em app, the Lotteries app, the My Casinos Austria app and the tipp3 app) without providing your personal data. However, different regulations may apply to the use of individual services, to which we shall refer separately.

When you visit our websites, information such as your IP address is sent to us. This information includes, for example, details of the end-user device being used (computer, smartphone, tablet, etc.), the browser being used (Internet Explorer, Safari, Firefox, etc.), the time of access to our websites and the amount of data transferred. This information may be processed for system security reasons (to protect against misuse), to determine the attractiveness of our websites or to continuously improve their content for you.

When downloading apps, you need to enter the necessary personal authentication details in the app store (e.g. Apple App Store, Google Play Store). We have no influence over or responsibility for the data collected in the course of the download, in particular the email address and customer number of your store account or the identification number of your end-user device. We process the device information in the data provided only to the extent that this is necessary for downloading our apps to your device. It will not be processed further by us.

For more information, please see the section ‘Data processing when using our apps’.

Our websites contain links to other websites. Compliance with the relevant data protection rules for such websites is the responsibility of the operators of those websites and is therefore beyond our control. Consequently, we bear no responsibility for the privacy policies or content of those other websites.

Consent on the basis of Sec. 107 (1) of the Austrian Telecommunications Act (Telekommunikationsgesetz, TKG) in conjunction with Art. 6 (1) lit a) of the General Data Protection Regulation (GDPR).

You have the option of subscribing to various forms of newsletters and/or mailings from our corporate group.

Depending on the scope of your declaration of consent and the purpose of data processing included therein, we may process various personal data (if you have provided such) for use in advertising, specifically your name, title, date of birth, nationality, residential address, telephone number, fax number, administrative user data, email address, your casino visits and gaming data, as well as information regarding your interests (e.g. gaming offers, events, hobbies, leisure time, sports, cultural and culinary preferences, promotions of which you may have taken advantage).

At such time as you provide your declaration of consent, you will be informed as to what personal data will be processed for what purpose in connection with making contact with us. If you have consented to receive information and mailings, then, depending on the scope of your declaration of consent, you may, for example, receive current news items and information regarding promotions and special offers as well as services and prize draws from the respective group company.

For information and mailings circulars, your email address, your postal address and your telephone number will be used if you have indicated these communication channels to us. In addition, you may receive information and mailings via our websites and apps in the form of push messages.

For more information on the option of withdrawing your consent, please see the section

“Right to withdraw consent“.

Your data will only be shared with third parties to the extent this is necessary in order to perform mailing tasks.

Legitimate interest on the basis of Sec. 107 (3) of the Austrian Telecommunications Act in conjunction with Art. 6 (1) lit f) of the General Data Protection Regulation (GDPR).

Where we receive your email address in connection with a sale or service (e.g. when you register with us in connection with a casino visit, with your participation in an advantage club, or when setting up an account on win2day), the company in question may, on the basis of the existing customer relationship and where there is a legitimate interest, forward direct advertising to you by email (including text messages) in the form of information and mailings relating to that company’s own or similar products and services. You may opt out at any time from such processing in connection with the collection of your contact data or each time the information is forwarded to you by email (“unsubscribe/abmelden“) or text message by sending an email to datenschutz@cal.at.

Legitimate interest of information in socially and politically relevant areas

In order to send you mailings with specialist information and invitations to events related to art and culture, Casinos Austria and its processors will process your personal data which have been transferred to us or which are publicly accessible, such as your title, name, home address and/or email address. These mailings are sent on the basis and for the purpose of the legitimate interest of the corporate group in promoting art and culture as socially and politically relevant areas.

In order to send you up-to-date specialist information on Casinos Austria in the form of a newsletter, Casinos Austria and its processors process your personal data which have been transferred to us or which are publicly accessible, such as your title, name, home address and/or email address. This information will be sent to interested persons and data subjects on the basis and for the purpose of the legitimate interest of the corporate group in passing on information about developments and events in the gaming sector as a socially relevant area.

It may be the case that photo and/or video recordings of you will be made and stored at Casinos Austria casinos, WINWIN VLT locations in connection with events, or during Austrian Lotteries TV shows.

Depending on whether you have given consent for this purpose to Casinos Austria or Austrian Lotteries, such recordings may be processed for purposes of marketing by Casinos Austria, WINWIN and/or Austrian Lotteries, for publication on their websites (www.casinos.at, www.lotterien.at, www.winwin.at) or on the local websites of Casinos Austria, for publication on the Facebook pages of those companies and for publication on Casino TV (infotainment at the casino/on tv.casino.at). In addition, depending on whether you have granted consent to Austrian Lotteries for this purpose, recordings made during shows may be processed for purposes of marketing in internal group media and potentially in third-party media, as described in your declaration of consent.

Such publication will not give rise to any claims on your part of any kind whatsoever.

For more information on the option of withdrawing your consent, please see the section

“Right to withdraw consent”.

In the case of participation in prize draws or non-cash prize lotteries, we will use your data collected for this purpose to process the prize draw or non-cash prize lottery and/or the resulting contractual relationship, particularly in connection with the notification of winnings. Detailed information may be found in the respective terms of participation. Where you have consented to this, we may process the data collected in connection with a prize draw or non-cash prize lottery until such time as you revoke consent to receive information and mailings circulars.

For more information on the option of withdrawing your consent, please see the section

“Right to withdraw consent”.

As a basic rule, we collect, process and use your data only on the basis of legitimate interests or your consent, and only so far as necessary for proper functioning of the apps or for conducting our own market and opinion research. We use tracking technologies to measure your usage behaviour.

For technical reasons, the apps automatically transmit certain technical data to our servers when you use our services, including, in particular, identifying characteristics, information on the beginning and end and the scope of the use in question and details regarding the services used by you in each case, for example the date and time of the use, the operating system used, the volume of data transmitted and configuration data. This is necessary due to the way our apps operate.

In addition, our apps use a token which is automatically generated when the app is first used. The token is a small text file (similar to a cookie) which is stored locally within the app and contains only a randomly generated identification number. The token serves as an identifier, allowing us to recognise your app installation in order to provide the required content to the app (e.g. permitting us to send push messages to the app where you have given your consent). The token is stored on our servers and in a special area of the app to which only the app has access. The token will be erased after four years of inactivity, which means that our servers will no longer recognise your app installation.

To use some of the offers and services of our corporate group, you must have an account on the Facebook social network, 1601 South California Avenue, Palo Alto, CA 94304, United States, or Amazon Media EU S.à r.l. (Société à responsabilité limitée), 5 Rue Plaetis, L- 2338 Luxemburg. When you visit Facebook pages or use an Alexa device, a direct connection is made between your device and the Facebook server or Amazon server. As a result, Facebook or Amazon will receive the information that you have called up our Facebook page or, using the Amazon Alexa device, Casinos Austria or skill lotteries under your IP address. We would point out to you that we have no knowledge of the content of the data transmitted or its use by Facebook or Amazon. You can find further information on these points at the Facebook privacy statement and/or Amazon privacy statement.

Content on external channels is created and extended with the utmost care. However, the degree of currency and correctness will be affected by technical factors such as the internet connection or the currency of the operating system you are using, and we are thus unable to guarantee it.

Visiting a casino

When visiting a Casinos Austria casino, you are legally obliged to present an official photo ID for the purpose of establishing and verifying your identity and your age and for compliance with legal duties of care. For this purpose, the data from your official photo ID will be stored in Casinos Austria’s customer database on the occasion of your first visit. On each subsequent visit, the data will be recorded, compared and checked, or if you visit our casinos with different official photo IDs, data from those IDs will also be stored. In the course of this procedure, Casinos Austria will process your name, title, date of birth, nationality, and ID data (ID type, ID number, master data, scan). In addition, every time you visit a casino, an up-to-date photo will be taken of you for the purpose of verifying your identity and will be stored in the customer database. Within the scope of legal requirements, your visit and gaming data will also be recorded and processed.

Glücks Card “points & more” programme

By participating in Casinos Austria’s Glücks Card “points & more” programme, you have the opportunity to participate in the Glücks Card bonus programme. For the purpose of implementing the Glücks Card “points & more” programme, and for customer support purposes and active player protection, Casinos Austria will process your personal data, if available and/or provided, such as email address(es), name, date of birth, nationality, address(es), telephone numbers(s), interests (cuisine, events, gaming offers), company, purchasing behaviour in the online shop, use of promotions/items consumed, participation in raffles and prize draws as well as your visiting and gaming data at the casinos.

On the basis of Sec. 107 of the Austrian Telecommunications Act in conjunction with Art. 6 (1) lit b) and with lit a) or lit f) of the General Data Protection Regulation (GDPR), you will receive information and mailings from Casinos Austria. The basis for the information and mailings is therefore either your consent or Casinos Austria’s legitimate interest in delivering direct advertising in the form of information and mailings to customers by means of email, SMS and post.

For more information on the options of withdrawing your consent and objecting to data processing, please see the sections “Right to withdraw consent” and “Right to object”.

Within the framework of the Glücks Card “points & more” programme and the casino information and mailings, Casinos Austria uses analytical software to calculate your bonuses and prepare and send you personalised direct advertising which is individually tailored to you. Our internal software is used to calculate your Glücks Card points and status points.

For more information about this, please see the sections “Information and mailings” and ”Analytical software”. The various advantages and terms of participation can be found at casinos.at.

Casinos Austria applications

The My Casinos Austria app, the online shop portal shop.casinos.at and the website casinos.at are software applications of Casinos Austria and are hereinafter referred to as apps. With the Casinos Austria apps, you as a non-registered user have the possibility to receive general information (e.g. opening hours, casinos, events) and offers (e.g. information on prize draws and offers) from Casinos Austria. It is also possible to place orders in the online shop without registering.

By registering with the apps, you transfer your email address and administrative user data (password, username=email address) to Casinos Austria for processing. IdentityID is used for processing, in order to protect your email address.

Registration enables you to use your My Casino account as well as the online shop and to participate in prize draw.

My Casino account:

You will be given the opportunity to have your My Casino account linked by Casinos Austria when you next visit the casino by presenting your official photo ID. The My Casino account will then be linked to your personal data from the Glücks Card “points & more” programme – if available and/or disclosed – such as email address(es), name, date of birth, citizenship, address(es), telephone number(s), interests (culinary, events, gaming offers), company, shopping behaviour in the online shop, use of promotions/consumption, participation in raffles and prize draws as well as your visit and gaming data in the casinos. By linking your My Casino account to the Glücks Card “points & more” programme, all of the aforementioned personal data will be processed by Casinos Austria, provided you have disclosed the information and not revoked it. Casinos Austria uses analytical software to show you person-specific content and content that is personalised for you. If you have your My Casino account linked, you must agree to the terms of participation in the Glücks Card “points & more” programme. Your data is processed in accordance with the privacy statement set out in the terms of participation and in accordance with this privacy statement.

If you have given your consent, you will also receive information and mailings about the Glücks Card “points & more” programme. If you have given your consent, you will receive push notices and mailings via the app. You can deactivate the push notices at any time and you can withdraw your consent to mailings without this limiting your ability to use the app.

For more information about the Casinos Austria App and the Glücks Card “points & more” programme, please see the sections “Glücks Card ‘points & more’ programme” “Information and mailings”, ”Data processing when using our apps” and “Analytical software“.

For more information on the option of withdrawing your consent, please see the section

“Right to withdraw consent”.

Online shop:

In the Casinos Austria online shop, you may purchase the products offered at shop.casinos.at/. When processing your order, Casinos Austria processes the following personal data: name, title, date of birth, email address, home address, as well as details of your purchasing behaviour and items purchased. Optionally, you may also provide to Casinos Austria your title, telephone number, company name and UID number. As a shop customer, you will also receive information and mailings, provided that you have given

your consent. Software is used to analyse your orders so we can send you personalised information about offers in our online shop. For more information, please see the sections ”Analytical software” and ”Information and mailings”.

For more information on the option of withdrawing your consent, please see the section

“Right to withdraw consent”.

Participation in prize draws:

Further information on data processing in connection with participation in prize draws can be found in the section Prize draws and non-cash prize lotteries.

Casino information and mailings

You will receive personalised information and mailings from Casinos Austria by email, SMS, post and telephone, provided you have given your consent. The information and mailings contain general news and news which has been personalised according to your interests about promotions and offers (e.g. entry price reductions, vouchers, dining services, events, highlights from the lottery world), gaming and betting offers (e.g. poker tournaments, casino tournaments), about services (e.g. information about player protection, customer surveys and benefits of the Glücks Card “points & more” programme), promotions from the Casinos Austria online shop (e.g. for purchasing vouchers, special offers and discounts), raffles as well as current prize draws of the Casinos Austria AG & Austrian Lotteries Group (Casinos Austria AG, Österreichische Lotterien Gesellschaft m.b.H., win2day Entwicklungs -und Betriebsgesellschaft m.b.H., Glücks- und Unterhaltungsspiel Betriebsges.m.b.H., Österreichische Sportwetten Gesellschaft m.b.H., Casinos Austria International Holding GmbH, Cuisino Ges.m.b.H. and Congress Casino Baden Betriebsgesellschaft m.b.H.). In addition, customer surveys may be conducted by Casinos Austria or commissioned market and opinion research institutes (such as IMAS International), which act for us as processors, within the scope of your consent.

As part of the Glücks Card “points & more” programme, you will receive information and mailings as well as benefits from cooperation partners where they are offered within the scope of the Glücks Card “points & more” programme, either on the basis of your consent or the legitimate interest Casinos Austria has in sending out direct advertising to guests. Customer surveys are sent out on the basis of your consent.

You may also receive information relating to mailings via the My Casinos Austria app and at reception or other points of contact at Casinos Austria casinos.

The personal data which you provide to Casinos Austria in the course of events, tournaments and prize draws shall be used for personalised mailings or sharing information, provided you have given your consent.

Within the scope of the casino information and mailings, Casinos Austria uses analytical software to send you direct advertising which is personalised to you. For more information, please see the section ”Analytical software”.

For more information on the option of withdrawing your consent, please see the section

“Right to withdraw consent”.

Feedback service

You can use the Feedback button at www.casinos.at to give general or specific feedback on the website (or an element of the website), make a specific request or ask a question to Casinos Austria. The Casinos Austria Service Center is available to answer your questions by email (service@casinos.at), telephone (+43 1 53440 50) and fax (+43 1 53440 22222). You can also use the feedback service on the website. The following personal data will be processed by Casinos Austria on the basis of your consent, if you provide it: your title, name, email address, home address and nationality.

For more information on the option of withdrawing your consent, please see the section

“Right to withdraw consent”.

Cuisino restaurant reservations

At Cuisino restaurants, you can reserve a table via the Quandoo service, by entering your personal data, such as your name, address and telephone number. You can also make your reservation by telephone or email. Cuisino processes the data you provide for the purpose of making your reservation.

Individual guest service

Provided you have given your consent for them to do so, Casinos Austria records your date of birth, your interests and hobbies, and your dining preferences in the casinos (e.g. food and beverages) in order to be able to best meet individual guests’ wishes and expectations.

For more information on the option of withdrawing your consent, please see the section

“Right to withdraw consent”.

Event calendar

On the Casinos Austria website (casinos.at), you can make reservations for specific events in the event calendar. For the purpose of making your reservation, Casinos Austria will process your name, title, email address, address, telephone number, date of birth and, optionally, your company name and telephone number.

Event management and marketing applications

Casinos Austria uses an event management and marketing application for the purpose of organising and managing events for companies and private individuals and to create accompanying work plans and reports. With the aid of this system and based on the event agreement, Casinos Austria processes your personal data – i.e. your name, telephone number, optionally your email address and physical address, and if available, data on your food and beverage orders – for the purpose of preparing quotations and invoices. In addition, Casinos Austria processes this data in order to ensure the proper handling of events (e.g. work orders to property management, technical services, reception and catering). This makes it possible to coordinate tasks for the events, promotions and activities that take place on a daily basis at the casinos.

For purposes of acquisitions and sales activities regarding its offers in the business-to- business (B2B) sector, Casinos Austria processes contact data of B2B customers (companies and associations). Provided consent has been given, B2B customers receive individual information and mailings from Casinos Austria. For more information, please see the sections ”Analytical software” and “Information and mailings”.

For more information on the option of withdrawing your consent, please see the section

“Right to withdraw consent”.

Lotteries information and mailings (Glückspost, Bingo News, STUDIO 44 GAME PLAN)

Provided you have declared your consent, you will receive information and mailings by email from Austrian Lotteries. Austrian Lotteries uses analytical software in order to send you personalised direct advertising that is individually tailored to you. For more information, please see the sections ”Analytical software” and “Information and mailings”.

For more information on the option of withdrawing your consent, please see the section

“Right to withdraw consent”.

Brieflos TV show – wheel contestant

On the basis of your consent, Austrian Lotteries will process the following personal data for the purpose of producing the Brieflos (break-open ticket) TV show: your name, address and telephone number. If you are selected, you will attend the Brieflos TV show, and Austrian Lotteries will contact you using the personal data you have provided.

In the course of your participation in the Brieflos TV show, you may consent to the processing and exploitation of all image and sound recordings created by you during the recording of the show and to public disclosure of the personal data you disclose during the recording for the purpose of promoting lottery products. You expressly release Österreichische Lotterien GmbH from the obligation of game secrecy for the performance of the data processing described above.

For more information on the option of withdrawing your consent, please see the section

“Right to withdraw consent”.

Lotteries Shaker app

With the Lotteries Shaker app, you can submit Lotto, LottoPlus, Joker and EuroMillions bets and also play scratch-off and break-open tickets. You require a win2day account to submit lottery bets and play the scratch-off and break-open tickets. The data processed for this purpose can be found under win2day account. For more information about the app, please see the section “Data processing when using our apps”.

Lotteries app

The Lotteries app is a service app based on the products played at the locations. Bets for Lotto, LottoPlus, Joker and EuroMillions can be submitted using the Lotteries app after making a pre-paid credit payment at Austrian Lotteries outlets. No registration is required to use this app. For more information, please see the section “Data processing when using our apps”.

On the basis of your declaration of consent, Österreichische Klassenlotterie Vertriebsgesellschaft m.b.H. will process the following personal data: your name, address, telephone number, fax and mobile phone numbers, email address, date of birth and bank details.

As a customer, you will receive an letter through the post before the start of the lottery, due to the legitimate interest that Österreichische Klassenlotterie Vertriebsgesellschaft m.b.H. has in sending out information to its customers. No additional advertising will be sent out.

You may object at any time to the sending of the letter, either by mail to office@klassenlotterie.at or by post to Österreichische Klassenlotterie Vertriebsgesellschaft m.b.H., Rennweg 44, 1038 Vienna.

Partners in the Association of Class Lottery Sales Locations are:

GST 23 HOHE BRÜCKE GmbH, Wipplinger Strasse 21, 1013 Vienna GST 28 J. Prokopp Ges.m.b.H., Mariahilfer Strasse 29, 1061 Vienna GST 33 GKL HOHE BRÜCKE GmbH, Wipplinger Strasse 21, 1010 Vienna GST 61 Franziska Hrubesch, 3502 Krems, Lerchenfelder Hauptplatz 10

GST 72 Oberbank AG, Untere Donaulände 28, 4020 Linz

GST 82 Paul Fochler Klassenlotterie GmbH, Tummelplatz 6, 8010 Graz

GST 88 Klassenlotterie Prokopp Int. GmbH, Mariahilfer Strasse 29, 1060 Vienna

As a matter of principle, no personal data are shared between Österreichische Klassenlotterie Vertriebsgesellschaft m.b.H and the partners of the Association of Class Lottery Sales Locations.

For more information on the option of withdrawing your consent and objecting to data processing, please see the sections “Right to withdraw consent” and “Right to object”

win2day account To use the win2day range of online games, you need to register at www.win2day.at. To do this, you provide your email address, account details, title, name and date of birth. Optionally, you may also provide a title. In the course of the registration process, your name, date of birth and place of residence are checked against the CRIF GmbH database

in order to comply with the terms of the gaming and betting regulations. After you have registered, you will have to provide identification and your bank details. Your identity is verified via the PhotoIdent process. Via PhotoIdent, you upload a photo and your identity document, which we process. If your identity is positively verified, then the data you have transmitted to us will be erased, otherwise it will generally be retained for a three-month period. If your identification is provided via mobile phone signature and online banking, your name and your birth date will be stored until the identity verification process is complete.

<u>Player protection measure:</u>

When using the win2day online service, a prevention tool for evaluating your gaming behaviour (especially gaming and usage data) is used to provide you with information and useful tips for your own responsible gaming. The tool is operated by our contractor neccton GmbH, Davidgasse 5, A-7052 Muellendorf. The related processing is based on Art 6 (1) lit b of the General Data Protection Regulation (fulfilment of contract), Art 6 (1) lit c of the General Data Protection Regulation (fulfilment of legal obligations) and Art 6 (1) lit f of the General Data Protection Regulation (protection of overriding legitimate interests of the controller). The overriding legitimate interest is to be able to implement and verify the statutory requirements for player protection.

win2day lounge

By participating in the win2day lounge, you will have the opportunity to take part in the Austrian Lotteries customer loyalty programme. For the purpose of implementing the win2day lounge and for the purposes of customer service, Austrian Lotteries processes your personal data – if it is available and/or has been disclosed – such as your name, gender, date of birth, address(es), telephone number, fax number, administrative user data, cookies, IP addresses, visiting and gaming data, interests and participation in raffles and prize draws. Upon termination of your participation in the win2day lounge, your data will no longer be processed for the aforementioned purposes.

On the basis of Sec. 107 of the Austrian Telecommunications Act in conjunction with Art. 6 (1) lit b) and lit a) or lit f) of the General Data Protection Regulation (GDPR), you will receive direct advertising by email from Austrian Lotteries in the form of information and mailings about the company’s own or similar products and services. The information and mailings are therefore sent either on the basis of your consent or the basis of the legitimate interests of Austrian Lotteries in sending information and mailings.

For more information on the option of withdrawing your consent and objecting to data processing, please see the sections “Right to withdraw consent” and “Right to object”

Within the framework of the win2day lounge, Austrian Lotteries uses analytical software to calculate your bonuses and to create and send you personalised direct advertising which is individually tailored to you.

For more information, please see the section “Analytical software”.

 

win2day information and mailings

As a win2day customer, due to win2day’s legitimate interest in sending customers direct advertising for win2day’s own and similar products and services, you will receive electronic mailings with personalised offers (e.g. free game credit, raffles, prize draws) and information about win2day’s gaming and betting offers. You may object to this

processing of your personal data. Within the scope of the mailings, win2day uses analytical software in order to send you personalised information and offers which are individually tailored to you. For more information, please see the sections “Information and mailings”, ”Analytical software” and ”Right to object”’.

 

win2day Casino, Lotto, Wetten app

With the win2day Casino, Lotto, Wetten app, you can use all the casino and lottery games and the sports betting range in one app. To participate in the gaming, you need a win2day account. For this purpose, win2day will process the data that you provide when you register. For more information, please see the sections ”Data processing when using our apps” and ”win2day account”.

 

win2day Poker – Texas Hold ’em app

With the win2day Poker – Texas Hold ’em app, you can play online poker as a cash game in an app. To participate in the game, you need a win2day account. For this purpose, win2day will process the data that you provide when you register. For more information, please see the sections ”Data processing when using our apps” and ”win2day account”.

Visiting a VLT location with the WINWIN card

Visiting VLT locations is only possible once you have registered at a VLT location and only with an active WINWIN card. Due to legal regulations, you are required to register and to present official photo identification. Your identity will be established and verified by means of your official photo ID. For this purpose, the data from your official photo ID will be stored on the occasion of your first visit, and then compared and checked on each subsequent visit. For the purpose of customer registration, WINWIN will process your name, address, ID number, type of ID, biometric data (photo), title (optional), mobile phone number and email address. WINWIN will also process your visit and gaming data, frequency of visits, length of stay and net gaming time, which are collected at WINWIN locations using the WINWIN card in order to comply with the player protection regulations of the Austrian Gaming Act. In addition, when you register on your first visit to a VLT location, an up-to-date photo is taken of you for the purpose of verifying your identity and is stored in the customer database. In some cases, e.g. if the photo is obviously not up to date, another one may have to be taken.

WINWIN information and mailings

Provided you have given your consent, WINWIN shall process the personal data that you provided during the registration process and subsequently collected, such as your title, name, address, mobile phone number, email address, data on use of promotions, and your visit and gaming data. You will receive information and mailings about offers and promotions (e.g. free game credits, highlights from the lottery world), gaming offers, services (e.g. player protection information, customer surveys, advantage clubs), advertising, prize draws and games of chance from WINWIN/Austrian Lotteries by post,

telephone, email and SMS.

The personal data which you provide to WINWIN in the course of events and prize draws shall be used for personalised mailings, provided you have given your consent.

WINWIN uses analytical software in order to send you personalised direct advertising which is individually tailored to you. For more information, please see the sections “Information and mailings” and ”Analytical software”.

For more information on the option of withdrawing your consent, please see the section

“Right to withdraw consent”.

tipp3 account

In order to use the Austrian Sports Betting Company’s online products (“tipp3”), and to participate in the “tipp3 Club”, the Austrian Sports Betting Company’s customer loyalty programme, you are required to register and create an account at www.tipp3.at. When you register, the following personal data will be processed by the Austrian Sports Betting Company on the basis of the agreement entered into with you: your name, title, date of birth, email address, administrative user data (password and username, i.e. your email address). In the course of the registration process, your name and date of birth are checked against the CRIF GmbH database in order to comply with the provisions of betting regulations. After you have registered, tipp3 will process your betting data. As soon as you wish to have your winnings paid out, your bank details will also be recorded and processed.

tipp3 club

By participating in the “tipp3 club”, you will have the opportunity to take part in the Austrian Sports Betting Company’s customer loyalty programme. For the purpose of running the “tipp3 club”, and for the purposes of customer support, the Austrian Sports Betting Company processes personal data, i.e. your name, title, date of birth, email address and gaming data. If you have given your consent to this, you will receive by email direct advertising in the form of information and mailings about the company’s own or similar products and services. You may object to this processing. For more information, please see the section ”Right to object”.

Within the scope of the “tipp3 club”, the Austrian Sports Betting Company uses analytical software to calculate your bonuses and to create and send you personalised direct advertising which is individually tailored to you.

For more information on the option of withdrawing your consent, please see the section

”Right to withdraw consent”.

For more information, please see the section “Analytical software”. The various advantages and terms of participation can be found at www.tipp3.at/Club.

tipp3 app

The tipp3 app is a service app based on the sports betting products played at the locations. No registration is required to use this app. It is also possible to place a bet via

the tipp3 app by loading credit in advance at the Austrian Sports Betting Company’s locations. For more information, please see the section “Data processing when using our apps”.

In the tipp3 app, you can link to the tipp3 account and the tipp3 club or register.

tipp3 information and mailings

Provided you have given your consent, you will receive personalised electronic mailings (e.g. in the form of online newsletters, vendor newsletters, club newsletters) with information about special offers and promotions (e.g. vouchers, free game credit), the range of betting products, services (e.g. information about player protection, customer surveys and advantage clubs), advertising, raffles and current prize draws from the Austrian Sports Betting Company. In the framework of the mailings, the Austrian Sports Betting Company will process your personal data, if available and/or disclosed, such as your name, date of birth, and your betting data.

The Austrian Sports Betting Company uses analytical software in order to send you personalised direct advertising which is individually tailored to you. For more information, please see the section ”Analytical software”.

For more information on the option of withdrawing your consent, please see the section

”Right to withdraw consent”.

Mailings with information from companies of our corporate group

Provided you have given your consent, you will also receive mailings from one of the companies of our corporate group (by post and electronically by email and text message) containing information from the Casinos Austria and Austrian Lotteries Group (Casinos Austria Aktiengesellschaft, Österreichische Lotterien Gesellschaft m.b.H., Casinos Austria Aktiengesellschaft, Österreichischen Lotterien Gesellschaft m.b.H., Glücks- und Unterhaltungsspiel Betriebsges.m.b.H., Österreichischen Sportwetten GmbH, Casinos Austria International Holding GmbH, Cuisino Ges.m.b.H. as well as Congress Casino Baden Betriebsges.m.b.H).

These mailings contain general and personalised information regarding promotions and special offers (e.g. highlights from the world of lotteries, free games or betting credit), our gaming and betting offers (e.g. poker tournaments, casino tournaments), the services we provide (e.g. information on player protection, customer surveys and customer advantage clubs) as well as current prize draws.

For these mailings, the respective company will process the following personal data, provided it has been disclosed: your name, title, date of birth, email address, residential address and nationality. There is no further disclosure or exchange of such data between companies of our corporate group.

For more information, please see “Information and mailings” and “Game secrecy”.

For more information on the option of withdrawing your consent, please see the section

”Right to withdraw consent”.

We use cookies on many of the websites of our corporate group. Cookies are small text files stored on your electronic device (e.g. computer, smartphone, game console) when you access those websites, enabling your browser to be identified when you visit the sites again.

In addition to our own cookies (first-party cookies), we also use professional services of third-party service providers, who install cookies on our website (third-party cookies). You may learn more about who third-party providers are and what their precise services are by reading their cookie policy on the third-party provider’s website.

We divide cookies into three categories: required cookies, analytical cookies and marketing cookies. You will find a more detailed description and explanation of these categories and the associated data processing in the cookies policies of their websites.

You will find an overview of the cookies we use, the cookies of third parties who install cookies on our website and the duration of cookie storage in the cookies policies of the relevant websites.

You can generally prevent cookies from being stored by using the appropriate settings in your browser software. However, we wish to point out that in such a case, you may not be able to use all of the functions of our websites to their full extent.

When you visit our websites, you will also receive information on the use and application of cookies via the cookie banner which appears on the website. You can amend or withdraw your consent at any time via the respective website.

The websites and apps of win2day (www.win2day.at) and the Austrian Sports Betting Company (www.tipp3.at) as well as the applications of Casinos Austria (My Casinos Austria app, casinos.at and shop.casinos.at) use sessions. The sessions (session ID, session number) are generated by the server at the beginning of your session. The session must be transferred to your computer or smartphone with the server’s response and supplied by the server with every further access. With the help of unique sessions, the data stored on the server (e.g. your betting slip) can be uniquely linked to a user at the time of each access. The session ends when you click on “Logout”. After a specified period of inactivity on the win2day and tipp3 websites, you will be automatically logged out and the session will also be terminated.

Fully automated decision-making processes

At present, there are no fully automated decision-making or profiling processes within the meaning of Art. 22 of the General Data Protection Regulation (GDPR) that take place within our corporate group, as no purely automated decisions are made which would have any legal effect on you or significantly affect you in a similar way.

Profiling for direct advertising purposes

For some mailings, we may use analytical software (HCL Campaign, Acoustic Campaign and/or Acoustic Analytics) in order to analyse personal information so that we may provide you with personalised offers and direct mailings tailored to your needs and requirements. Based on the information collected under each customer loyalty programme and/or newsletter programme, we are able to provide you with personalised and customised offers and information.

In connection with customer loyalty programmes and/or advantage clubs, you also agree that your data will be processed by means of the analytical software so that we may calculate bonuses (e.g. Glücks Card and status bonuses in the case of the Glücks Card “points & more” programme of Casinos Austria or balls in the case of the tipp3 club).

The information and mailings for which this software is used are listed in our corporate group’s list of products. Details on how to unsubscribe from information and mailings for which we use this analytical software may also be found in each individual mailing and in the terms of our bonus programmes/benefit clubs.

For more information on the option of withdrawing your consent and objecting to data processing, please see the sections “Right to withdraw consent” and “Right to object”.

Profiling for application usage

Various marketing and analytical systems (e.g. HCL Campaign, Acoustic Campaign, Acoustic Analytics, Google Analytics, Econda as well as Matomo) are used to analyse usage of the corporate group’s applications and websites.

<u>HCL Campaign, Acoustic Campaign (Casinos Austria app)</u>

This enables us to evaluate your usage data in order to improve our provision of information and to tailor the app to your individual needs. This data is processed by HCL and Acoustic as contract processors within the European Union. The information generated by the tracking code about the use of the app is transferred to a server in Germany and stored there. HCL and Acoustic use this information on behalf of Casinos Austria to evaluate the use of the app, to compile reports on app activity and to provide other services related to app use and internet use to Casinos Austria as the controller. The personal data transmitted by the app within the scope of HCL Campaign, Acoustic Campaign and Acoustic Analytics, such as IP address, device data and account ID, are not merged with HCL or Acoustic’s other data. Your data is only stored for as long as necessary to use the app or is deleted after three years from the last time you used the app. Data on usage of the app will be deleted after a maximum of 27 months.

<u>Analytical tools on our websites:</u>

The information on data processing in connection with the use of the analytical and marketing systems on our websites can be found in our Cookie Policy.

We will store data you have provided to us solely for the purposes of customer service or for marketing and information purposes (such as newsletters) until such time as you withdraw your consent to this. Otherwise, your personal data will be automatically erased or blocked for further use if you have not used our online services or other services and products for a period of more than three years (from the date of your last contact with

us or the last use of the services).

In the case of a contract such as in connection with your visit to a casino or VLT location or for your use of our online products, your personal data will, in any event, be stored following complete performance of the contract until expiry of any statutory retention periods applicable to us, and, in addition, until conclusion of any legal disputes as to which data may be required as evidence. Ensuring proper performance of our legal and licensing obligations in the area of player protection and prevention of money laundering may also require a longer duration of storage in individual cases.

Legal storage obligations arise for us in particular from the following provisions:

• Sec. 212 (1) of the Austrian Commercial Code (Unternehmensgesetzbuch, UGB)
• Sec. 132 (1) of the Austrian Federal Tax Code (Bundesabgabenordnung, BAO)
• Sec. 21 (1) of the Financial Markets Anti-Money Laundering Act (Finanzmarkt-Geldwäschegesetz, FM-GwG)

You may assert the following rights regarding the processing of your data under the General Data Protection Regulation (GDPR) and national data protection legislation:

Right to access

You may ask us for information as to whether we process your personal data, and if so, which of your personal data we process and to what extent.

Right to rectification

If we process personal data of yours which is incomplete or incorrect, you may request its rectification and/or completion by us at any time.

Right to erasure

You may request that we erase your personal data if we have unlawfully processed it, if the processing disproportionally interferes with your legitimate interests of protection, if your personal information is no longer necessary for the purposes for which it was collected, if you have withdrawn your consent and there is no other legal basis for processing or if erasure of the data is required to fulfil a legal obligation. Please note that there may be reasons which would militate against immediate erasure, e.g. in the case of legally mandated retention requirements.

Right to restriction of processing

You may ask us to restrict the processing of your data if

· you dispute the correctness of the data for a period of time that allows us to verify the accuracy of the data;

· the processing of your data is unlawful, but you opt against erasure and instead request restriction of the use of your data;

· we no longer need the data for its intended purpose, but you still need the data to assert, exercise or defend your legal rights, or

· you have objected to the processing of the data.

From the time of the request for restriction, such data will only be processed with your individual consent or for purposes of asserting and enforcing legal claims.

Right to data portability

You may ask us to provide you with the data which you have given to us in a structured, commonly used and machine-readable format, provided that

· we process such data on a basis of consent you have given, and which may be withdrawn, or to perform a contract between us, and

· the processing is carried out by means of automated procedures.

Right to withdraw consent

You may withdraw your consent to data processing under data protection law at any time with future effect by sending an email to datenschutz@cal.at or to the email address given in the declaration of consent, or by post, stating the company in question, to Rennweg 44, 1038 Vienna. For mailings sent by email, you may also withdraw your consent by using the “unsubscribe/abmelden” link in any email. Withdrawal of your consent shall not affect the lawfulness of processing based on your consent before its withdrawal.

Right to object

For reasons arising out of your particular situation, you may, in principle, object to the processing of personal data concerning you which are required in order to safeguard our legitimate interests or those of a third party when collecting your contact details (opt-out) via datenschutz@cal.at or by post to Rennweg 44, 1038 Vienna, stating the company in question. For mailings sent by email, you may also withdraw your consent by using the “unsubscribe/abmelden” link in any email. Following your objection, your data will no longer be processed unless there are compelling legitimate grounds for processing it which outweigh your interests, rights and freedoms, or if the processing is for the purpose of asserting, exercising or defending legal claims.

You may object at any time to our forwarding of advertising to you without any need to state reasons for this.

Right to lodge a complaint

If you believe that we are in violation of Austrian or European data protection laws when processing your data, we would ask you to contact us in order to resolve any questions you may have. You also have the right to contact the Austrian Data Protection Authority (Datenschutzbehörde), the competent supervisory authority.

Assertion of rights

If you wish to assert one of the rights referred to above in relation to us, please simply use the email address: datenschutz@cal.at.

In connection with your assertion of your rights, it is possible that we may request additional information to confirm your identify (such as official photo ID). The purpose of this is to protect your rights and your privacy, and in particular, to comply with a high standard of care with regard to game secrecy and to ensure that no third party may access your data.

We will respond to all reasonable requests as soon as possible in accordance with applicable law.

We will update our privacy statement from time to time. Amendments to our privacy statement will become effective when provided on our corporate group’s websites and apps and posted at our casinos and VLT locations. If we make substantial amendments, we will inform you of this via our online services.