1. Data Controller

The entity responsible for the collection and processing of your personal data (the "Data Controller") is:

1.1 Data Protection Officer (DPO)

We have appointed a Data Protection Officer who is responsible for overseeing matters relating to this Privacy Policy and our data protection compliance. You may contact our DPO at any time with questions, concerns, or requests regarding the processing of your personal data:

2. Personal Data We Collect

Depending on how you interact with us, we may collect and process various categories of personal data. "Personal data" means any information relating to an identified or identifiable natural person. We collect personal data through different channels, including directly from you, automatically when you use our Website, and from third parties.

2.1 Data You Provide Directly to Us

• Identity Data: Full name, date of birth, gender, nationality, passport or government-issued identification number, and copies of identity documents where required for regulatory purposes.
• Contact Data: Email address, postal address, telephone number, and other contact details.
• Reservation and Booking Data: Arrival and departure dates, room type and preferences, number of guests, special requests, loyalty programme membership number, and details of services booked.
• Payment Data: Credit or debit card details, billing address, transaction history, and bank account information where applicable. Please note that full payment card data is processed securely through our PCI-DSS compliant payment processors.
• Account Data: Username, password, account preferences, and communication preferences if you register for an account or loyalty programme on our Website.
• Communications Data: Content of messages, emails, chat conversations, or other correspondence you send us, including feedback, complaints, and enquiries.
• Marketing Preferences: Your preferences regarding receiving marketing communications from us and your selected areas of interest.
• Event and Conference Data: Information provided when booking event spaces, meeting rooms, or catering services, including organisational details and attendee information.

2.2 Casino-Specific Data

In connection with our casino operations, and to comply with applicable gaming regulations and anti-money laundering legislation, we may additionally collect:

• Identity Verification Data: Copies of government-issued photo identification, proof of address, and other Know Your Customer ("KYC") documentation as required by law.
• Gaming Activity Data: Records of gaming sessions, games played, wagers placed, wins and losses, gaming preferences, and player account history.
• Financial Due Diligence Data: Source of funds information, financial transaction records, and other anti-money laundering (AML) and counter-terrorist financing (CTF) data.
• Responsible Gaming Data: Self-exclusion requests, deposit limits, session time limits, and other responsible gaming preferences or restrictions.
• Player Protection Data: Information relating to player welfare assessments and interactions with our responsible gaming team.

2.3 Data Collected Automatically

When you visit our Website, we may automatically collect the following data through cookies and similar tracking technologies:

• Technical Data: IP address, browser type and version, operating system, device type, device identifiers, time zone setting, and browser plug-in types.
• Usage Data: Pages visited, links clicked, time spent on pages, referring URLs, navigation paths, and search queries on our Website.
• Cookie Data: Data stored in cookies and similar tracking technologies. Please refer to our Cookie Policy for more information on how we use cookies.
• Location Data: General geographic location inferred from your IP address.

2.4 Data Received from Third Parties

• Booking Platform Data: Personal data received from online travel agencies (OTAs), booking platforms, or other intermediaries when you make a reservation through them.
• Social Media Data: If you interact with our social media pages or choose to log in via a social media account, we may receive certain profile data from the relevant social media platform.
• Payment Verification Data: Fraud prevention and verification data from payment processors and financial institutions.
• Analytics Providers: Aggregated and anonymised data from third-party analytics services to help us understand how our Website is used.

2.5 Special Categories of Personal Data

We do not generally seek to collect special categories of personal data (as defined under GDPR Article 9), such as data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation. However, in limited circumstances we may process such data where:

• You have provided explicit consent (for example, dietary requirements that may reveal religious beliefs or health conditions, provided voluntarily for the purposes of catering);
• It is necessary for reasons of substantial public interest under applicable law; or
• You have voluntarily made the data manifestly public.

Where we process special categories of personal data, we will ensure that an additional lawful basis under GDPR Article 9(2) applies, and we will handle such data with the highest level of care and protection.

2.6 Data Relating to Criminal Convictions

In connection with our casino operations and as required by applicable gaming and anti-money laundering regulations, we may be required to process data relating to criminal convictions and offences. Such processing will only be carried out to the extent permitted under applicable law and under the control of official authority or where authorised by law.

3. Legal Basis for Processing Your Personal Data

We are required under GDPR Article 6 to identify a lawful basis for each processing activity involving your personal data. We rely on the following legal bases:

3.1 Performance of a Contract (Article 6(1)(b))

We process your personal data where it is necessary to fulfil a contract to which you are a party or to take steps at your request prior to entering into a contract. This includes:

• Processing your reservation, check-in, and check-out;
• Providing hotel accommodation, room services, dining, spa, and other hotel amenities;
• Administering your gaming account and processing gaming transactions;
• Processing payments for services rendered;
• Managing your loyalty programme membership;
• Responding to pre-contractual enquiries about our services.

3.2 Compliance with a Legal Obligation (Article 6(1)(c))

We process your personal data where it is necessary to comply with a legal obligation to which we are subject, including:

• Anti-money laundering (AML) and counter-terrorist financing (CTF) obligations under applicable legislation;
• Know Your Customer (KYC) and identity verification requirements under gaming regulations;
• Tax and accounting obligations, including the retention of financial records;
• Compliance with gaming and casino licensing requirements issued by applicable regulatory authorities;
• Reporting obligations to regulatory, law enforcement, or government authorities as required by law;
• Health and safety obligations;
• Compliance with court orders, legal proceedings, and judicial or governmental requests.

3.3 Legitimate Interests (Article 6(1)(f))

We process your personal data where it is necessary for the purposes of our legitimate interests or those of a third party, except where such interests are overridden by your interests or fundamental rights and freedoms. Our legitimate interests include:

• Improving and personalising the experience on our Website and in our facilities;
• Detecting, preventing, and investigating fraud, security incidents, and other illegal activity;
• Ensuring the physical security of our hotel and casino premises, including through CCTV surveillance;
• Analysing how our Website and services are used in order to improve them;
• Sending direct marketing communications about similar products and services to existing customers (subject to your right to opt out at any time);
• Managing and administering our business operations effectively;
• Protecting and enforcing our legal rights and those of our guests and employees;
• Conducting customer satisfaction surveys and research to improve our services;
• Network and information security management.

When we rely on legitimate interests, we carry out a balancing test to ensure that our interests do not override your rights and freedoms. You have the right to object to processing based on legitimate interests at any time. Please see Section 8 for further information on your rights.

3.4 Consent (Article 6(1)(a))

In certain circumstances, we will ask for your explicit consent before processing your personal data. This includes:

• Sending you marketing communications where you are not an existing customer;
• Placing non-essential cookies and similar tracking technologies on your device;
• Processing special categories of personal data such as dietary preferences that may reveal religious beliefs or health conditions;
• Sharing your data with carefully selected third-party partners for their own marketing purposes, where you have opted in to such sharing.

Where we rely on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing carried out prior to such withdrawal. You may withdraw consent by contacting us at info@orvellanroyalcrest.com or by using the unsubscribe mechanism included in any marketing communication we send you.

3.5 Vital Interests (Article 6(1)(d))

In exceptional circumstances, we may process personal data where it is necessary to protect the vital interests of you or another natural person, such as in a medical emergency involving a guest on our premises.

3.6 Public Task (Article 6(1)(e))

We may process personal data where this is necessary for the performance of a task carried out in the public interest or in the exercise of official authority. In the context of casino operations, this may include cooperating with regulatory and law enforcement bodies in the exercise of their statutory functions.

4. How We Use Your Personal Data

We use the personal data we collect for the following purposes:

4.1 Hotel Services and Operations

• To process, confirm, and manage your accommodation bookings and reservations;
• To facilitate your check-in and check-out process;
• To provide you with the hotel services, amenities, and experiences you have requested;
• To process payments and handle billing and invoicing;
• To manage your loyalty programme account and administer associated benefits and rewards;
• To accommodate special requests, dietary requirements, and accessibility needs;
• To communicate with you before, during, and after your stay regarding your reservation and experience.

4.2 Casino Operations

• To create, verify, and administer your gaming account;
• To process gaming transactions, deposits, withdrawals, and winnings;
• To conduct required identity verification and KYC procedures;
• To comply with AML, CTF, and other applicable gaming regulations;
• To implement and manage responsible gaming measures, including self-exclusion programmes and spending limits;
• To detect and prevent problem gambling and to provide player protection services;
• To monitor gaming activity for the purposes of fraud prevention and regulatory compliance.

4.3 Website and Digital Services

• To operate, maintain, and improve our Website and digital services;
• To personalise your online experience and display content relevant to your interests;
• To enable you to create and manage an online account;
• To analyse Website usage and user behaviour to improve our online presence;
• To administer and protect our Website, including troubleshooting, data analysis, and system testing.

4.4 Marketing and Communications

• To send you promotional offers, newsletters, and marketing communications about our hotel, casino, events, and services where we have a lawful basis to do so;
• To personalise marketing communications based on your preferences and prior interactions with us;
• To conduct customer satisfaction surveys and collect feedback about your experience;
• To invite you to participate in loyalty programmes, competitions, and special promotions.

4.5 Security and Fraud Prevention

• To ensure the physical security of our hotel and casino premises through CCTV and access control systems;
• To detect, investigate, and prevent fraud, theft, and other unlawful activity;
• To verify your identity and prevent unauthorised access to accounts and services;
• To protect the rights and safety of our guests, employees, and other individuals on our premises.

4.6 Legal and Regulatory Compliance

• To comply with all applicable legal, regulatory, and licensing requirements;
• To respond to requests from regulatory authorities, law enforcement agencies, and courts;
• To establish, exercise, or defend legal claims;
• To maintain accurate records for tax, audit, and accounting purposes.

4.7 Business Management

• To carry out internal business functions including financial management, human resources administration, and corporate reporting;
• To conduct internal research and analytics for strategic business planning purposes;
• To manage relationships with suppliers, partners, and service providers.

5. Sharing Your Personal Data

We do not sell your personal data to third parties. We may share your personal data with the following categories of recipients, only to the extent necessary and for the purposes described in this Privacy Policy:

5.1 Service Providers and Data Processors

We engage carefully selected third-party service providers who process personal data on our behalf and under our instructions as data processors. These include:

• IT and Technology Providers: Cloud hosting services, website and database management, cybersecurity, and software providers;
• Payment Processors: PCI-DSS compliant payment gateway operators and financial institutions that process card transactions and other payments;
• Booking and Reservation Platforms: Online travel agencies (OTAs) and channel management systems used to facilitate reservations;
• Marketing and Communications Providers: Email marketing platforms, CRM systems, and digital advertising networks used to deliver marketing communications;
• Analytics Providers: Web analytics services used to analyse Website traffic and usage;
• Gaming Technology Providers: Casino management systems, gaming software providers, and responsible gaming tool providers;
• Identity Verification Services: KYC and AML compliance technology providers;
• Customer Support Tools: Help desk software and live chat service providers;
• Security and Surveillance Providers: CCTV system operators and physical security service providers;
• Professional Advisors: Legal counsel, accountants, auditors, and insurance providers.

All data processors are bound by written data processing agreements that require them to process personal data only on our instructions, maintain appropriate security measures, and comply with applicable data protection law.

5.2 Regulatory and Law Enforcement Authorities

We may disclose your personal data to regulatory bodies, gaming authorities, law enforcement agencies, tax authorities, courts, and other governmental bodies where we are required or permitted to do so by applicable law, regulation, or legal process, including but not limited to:

• Alcohol and Gaming Commission of Ontario (AGCO) and other gaming regulators;
• Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) for AML reporting purposes;
• Canada Revenue Agency (CRA) for tax compliance purposes;
• Law enforcement agencies in connection with the investigation of criminal activity;
• Courts and tribunals in connection with legal proceedings.

5.3 Business Transfers

In the event of a merger, acquisition, reorganisation, sale of assets, or insolvency proceeding involving , your personal data may be transferred to the relevant third party as part of that transaction. We will notify you of any such transfer and any choices you may have regarding your personal data in accordance with applicable law.

5.4 Group Companies

We may share your personal data with affiliated companies within our corporate group where necessary for the purposes described in this Privacy Policy, including for the administration of shared services and systems.

5.5 Other Third Parties with Your Consent

Where you have given us your explicit consent to do so, we may share your personal data with carefully selected third-party partners for their own marketing and promotional purposes. You may withdraw such consent at any time.

5.6 International Transfers of Personal Data

Some of our service providers and partners may be located outside of Canada and, where applicable, outside of the European Economic Area (EEA). Where we transfer personal data to recipients in countries that do not provide an equivalent level of data protection, we will ensure that appropriate safeguards are in place, which may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Adequacy decisions by the European Commission or the relevant supervisory authority;
• Binding Corporate Rules where applicable;
• Other appropriate transfer mechanisms permitted under applicable law.

You may request further information about international transfers of your personal data and the safeguards in place by contacting us at info@orvellanroyalcrest.com.

6. How Long We Retain Your Personal Data

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, regulatory, accounting, or reporting obligations. The appropriate retention period is determined by taking into account the nature and sensitivity of the data, the purposes for which it is processed, and the applicable legal requirements.

6.1 General Retention Periods

At the end of the applicable retention period, personal data will be securely deleted or anonymised so that it can no longer be associated with you. In some circumstances, we may anonymise your personal data for statistical or research purposes, in which case we may retain and use such anonymised data indefinitely without further notice to you.

7. Your Rights Under Data Protection Law

Subject to the conditions and limitations set out in applicable data protection legislation, you have the following rights in respect of your personal data. We will respond to all valid requests within one (1) month of receipt. In complex cases or where we receive a high volume of requests, we may extend this period by a further two (2) months, and we will notify you accordingly.

7.1 Right of Access (Article 15 GDPR)

You have the right to obtain confirmation as to whether we are processing your personal data and, where we are, to receive a copy of that personal data together with certain supplementary information including the purposes of processing, the categories of data processed, the recipients to whom data is disclosed, and the applicable retention periods.

7.2 Right to Rectification (Article 16 GDPR)

You have the right to request that we correct any inaccurate personal data we hold about you and that we complete any incomplete personal data, having regard to the purposes for which it is processed.

7.3 Right to Erasure / Right to be Forgotten (Article 17 GDPR)

In certain circumstances, you have the right to request that we delete your personal data. This right applies where, for example:

• The personal data is no longer necessary for the purposes for which it was collected;
• You withdraw your consent on which the processing is based and there is no other legal basis for the processing;
• You object to the processing and there are no overriding legitimate grounds for continuing it;
• The personal data has been unlawfully processed;
• The personal data must be erased to comply with a legal obligation.

Please note that this right is not absolute and may be subject to exceptions, in particular where processing is necessary for compliance with a legal obligation or for the establishment, exercise, or defence of legal claims.

7.4 Right to Restriction of Processing (Article 18 GDPR)

You have the right to request that we restrict the processing of your personal data in certain circumstances, including where:

• You contest the accuracy of the personal data, pending verification by us;
• The processing is unlawful and you oppose erasure, requesting restriction instead;
• We no longer need the personal data but you require it for the establishment, exercise, or defence of legal claims;
• You have objected to processing based on legitimate interests, pending verification of whether our legitimate grounds override yours.

Where processing is restricted, we will continue to store your personal data but will not otherwise process it except with your consent, or for the establishment, exercise, or defence of legal claims, or for the protection of the rights of another person, or for reasons of important public interest.

7.5 Right to Data Portability (Article 20 GDPR)

Where processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.

7.6 Right to Object (Article 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data where such processing is based on our legitimate interests (Article 6(1)(f)). We will cease processing the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defence of legal claims.

You have an absolute right to object to the processing of your personal data for direct marketing purposes at any time, without giving any reason. If you object to direct marketing, we will stop processing your personal data for such purposes immediately.

7.7 Rights in Relation to Automated Decision-Making and Profiling (Article 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Where we engage in any such automated decision-making, we will inform you of this and provide you with the opportunity to request human review, express your point of view, and contest the decision.

7.8 Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to the withdrawal. You may withdraw consent by contacting us at info@orvellanroyalcrest.com or, for marketing communications, by using the unsubscribe link in any marketing email we send you.

7.9 Right to Lodge a Complaint

If you are located in the European Economic Area and believe that our processing of your personal data infringes applicable GDPR requirements, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, your place of work, or the place of the alleged infringement.

If you are located in Canada, you have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca.

We encourage you to contact us first before lodging a complaint with a supervisory authority, so that we have the opportunity to address your concerns directly.

7.10 Exercising Your Rights

To exercise any of the rights described above, please submit a written request to us using the contact details provided in Section 9 of this Privacy Policy. We may need to verify your identity before processing your request in order to protect your personal data from unauthorised access. We will not charge a fee for handling your request unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request.

8. Cookies and Tracking Technologies

Our Website uses cookies and similar tracking technologies to distinguish you from other users, to enhance your browsing experience, and to provide us with information about how our Website is used. Cookies are small text files placed on your device when you visit a website.

We use the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the operation of our Website and cannot be switched off. They are set in response to actions you take such as logging in, completing forms, or making a reservation.
• Performance and Analytics Cookies: These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our Website. All information collected is aggregated and anonymised.
• Functionality Cookies: These cookies enable enhanced functionality and personalisation, such as remembering your language preferences or login details.
• Targeting and Advertising Cookies: These cookies are used to deliver advertisements more relevant to you and your interests. They may also be used to limit the number of times you see an advertisement.

You can control and manage cookies through your browser settings and through our cookie consent tool, which is presented to you upon your first visit to our Website. Please note that disabling certain cookies may affect the functionality of our Website. For further information about the cookies we use, please refer to our Cookie Policy, available on our Website.

9. Data Security

We have implemented appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include, but are not limited to:

• Encryption of data in transit using Secure Socket Layer (SSL) / Transport Layer Security (TLS) technology;
• Encryption of sensitive personal data at rest;
• Access controls and role-based permissions to limit access to personal data to authorised personnel only;
• Regular security assessments, penetration testing, and vulnerability scanning;
• Data minimisation practices to ensure we collect and retain only the personal data that is necessary;
• Staff training on data protection and information security;
• Incident response procedures to manage and mitigate the impact of data security breaches;
• PCI-DSS compliance for the processing of payment card data.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach as required by GDPR Article 33, and will notify you directly where the breach is likely to result in a high risk to your rights and freedoms, in accordance with GDPR Article 34.

While we take all reasonable steps to protect your personal data, no method of transmission over the internet or method of electronic storage is completely secure. We therefore cannot guarantee absolute security of your personal data.

10. Third-Party Links and Services

Our Website may contain links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices or content. We encourage you to read the privacy policy of every website you visit.

11. Children's Privacy

Our Website and services, and in particular our casino services, are not directed at children under the age of 18 (or the applicable age of majority in your jurisdiction). We do not knowingly collect personal data from persons under the age of 18. If you are under 18, please do not use our Website, access our casino services, or provide any personal data to us. If we become aware that we have inadvertently collected personal data from a person under the age of 18, we will take immediate steps to delete such data. If you believe that a minor has provided us with personal data, please contact us at info@orvellanroyalcrest.com.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in applicable law, or for other operational or regulatory reasons. Any changes we make will be posted on this page, along with an updated "Last updated" date at the top of the policy. Where changes are material, we will take reasonable steps to notify you, which may include displaying a prominent notice on our Website or sending you an email notification if you have provided us with your email address.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Your continued use of our Website or services after any changes to this Privacy Policy shall constitute your acknowledgement of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which we process your personal data, please do not hesitate to contact us using the details below. We are committed to working with you to resolve any concerns promptly and in accordance with your rights.

If you are not satisfied with our response, or if you believe that we are processing your personal data in a manner that does not comply with applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority:

• Canada: Office of the Privacy Commissioner of Canada (OPC) — www.priv.gc.ca
• European Union (EEA residents): The data protection supervisory authority in your EU Member State of residence or habitual place of work.