This document outlines the processing of your personal data and the rights you have under the current data protection regulations—Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, concerning the protection of natural persons with regard to the processing of personal data, and the regulations that develop it, hereinafter referred to as the “GDPR.” The type of data processed and its use may vary depending on the relationship we maintain with you and the services requested and/or provided.

Data Controller and Contact Information

The entity responsible for processing your data is CELEVENTOS, S.L., with its registered office at Avda. Alejandro Valverde, 170, 30007 Murcia.

If you wish, you may contact the Data Protection Officer via the following email address: dpo@orenesgrupo.com or by postal mail at the above address.

For What Purpose Do We Process Your Data (Processing Purpose) and On What Legal Basis?

Personal data is processed in accordance with the provisions of the GDPR, based on the following legal grounds:

For the execution or fulfillment of contractual obligations – Art. 6.1 (b) GDPR

To fulfill our contractual obligations towards you, including registering an account to use our services.

• Management of contracted services, as well as compliance with accounting, legal, tax, and administrative obligations.
• Issuance of winnings certificates for players who request them.
• Management of jackpot prize winners’ registration.
• Management of reservations at hospitality establishments and verification of ownership.
• Management of home delivery orders from hospitality establishments. Order delivery.

Justified by a Legitimate Interest – Art. 6.1 (f) GDPR

When necessary, CELEVENTOS, S.L. will process your personal data to satisfy its own or third-party legitimate interests in the following cases:

• Management of customer complaints.
• Implementation of controls for detecting fraudulent activities.
• Recording visits to the central offices of Grupo Orenes.
• Management of high-profile customer information and communications related to invitations to special events.
• Study and analysis of the customer identification process and/or activity for fraud detection.

Consent – Art. 6.1 (a) GDPR

Whenever you have given us your consent, we may carry out additional processing operations that have been communicated to you and to which you have consented. You may revoke your consent at any time. This also applies if your consent was given before the GDPR came into effect (May 25, 2018). It should be noted that opposition to a specific processing operation and the revocation of consent are not retroactive. You can obtain information about the authorizations you have granted at any time by exercising your rights in accordance with section 8.

CELEVENTOS, S.L. will request your authorization to process your data for the following purposes:

• Management of contact data collected through corporate website forms.
• Management of cash prize payments.
• Sending commercial, promotional, and/or advertising communications, which may be based on contracted products or services provided.
• Automatic categorization of your user profile based on gaming patterns to receive tailored communications according to your preferences and needs. Personal data may be processed to create profiles based on internal sources (e.g., browsing data, historical and statistical data), allowing for segmentation into different groups based on common patterns. Such profiling will only be used to send you personalized communications about products and/or services.
• Providing my contact details to Grupo Orenes companies (+info) so they can send me commercial communications about their products and services.
• Management of photographs of participants in poker tournaments, themed dinners, other organization events, and/or testimonials.
• Verifying customer identity through facial recognition systems to facilitate registration and access control at venues.
• Capturing images of roulette customers in the casino for online reproduction.
• Management of the customer service department to resolve inquiries generated by customers or potential customers.
• Management of Wi-Fi service in our establishments for customers and visitors.
• Management of participant registration for sweepstakes.
• Management of satisfaction surveys sent to customers about our services.

By Legal Obligation or in the Public Interest – Art. 6.1 (c) and (e) GDPR

As a company in the gambling and betting sector, CELEVENTOS, S.L. is subject to various legal obligations (e.g., Gaming Regulation Law, Anti-Money Laundering and Terrorism Financing Law, Tax Law) and various supervisory regulations.

Thus, we process data on this legal basis in the following cases:

• Management of the player portfolio using services, including prize payments and registration at facilities.
• Managing registered players’ information on the online sports betting and casino platform, including prize payments and access records.
• Managing the register of prohibited players to prevent their access to Grupo Orenes facilities or services.
• Registering winners and managing prizes exceeding €2,000.
• Compliance with Grupo Orenes’ legal obligations regarding Anti-Money Laundering Prevention.
• Conducting audits or external reviews required by applicable regulations or voluntarily carried out to verify our internal control framework.
• Recording images in Grupo Orenes facilities for security reasons and collecting evidence in cases of theft and/or fraud.
• Completing entry logs at hospitality establishments and, if applicable, informing Law Enforcement Authorities.
• Management of administrative or judicial cases involving customers and Grupo Orenes. This processing may also be based on Grupo Orenes’ legitimate right to effective legal protection, both in its right of defense and in the filing of judicial claims deemed appropriate, based on civil or criminal procedural law.
• Managing complaints related to actions or behaviors, past or present, contrary to our Ethical Code or applicable legislation received through the organization’s various reporting channels, as well as handling and investigating them.
• Responding to data subject rights requests in accordance with data protection regulations.

Who Will Your Data Be Shared With?

To carry out all the purposes described above, CELEVENTOS, S.L. collaborates with third-party service providers who may have access to personal data as a result of providing contracted services. In any case, CELEVENTOS, S.L. follows strict selection criteria for these third parties to comply with its data protection obligations and signs the corresponding data protection agreement with them. These agreements oblige third parties to comply with legal, technical, and organizational measures regarding data processing, ensuring data protection compliance, and prohibiting the processing of personal data for other purposes or transferring it to third parties.

Your data may also be disclosed to Public Authorities, the Tax Agency, Judges, and Courts, and, in general, to Competent Authorities when CELEVENTOS, S.L. is legally required to provide them.

Additionally, CELEVENTOS, S.L. must notify the Commission for the Prevention of Money Laundering (SEPBLAC) of any suspicion of money laundering or terrorism financing and provide necessary identifying data of the involved users, making the collected information available to judicial authorities for related investigations.

Data transfers to non-EU countries (so-called “third countries”) will only occur if the European Commission has determined that the third country ensures an adequate level of protection, if required by law (e.g., tax reporting obligations), if you have given consent, or within the framework of data processing as service providers.

Orenes informs that to send advertisements electronically, it uses a U.S.-based provider, Salesforce, resulting in an international data transfer. This provider has binding corporate rules ensuring compliance with GDPR standards.

Similarly, for customer service purposes, Orenes uses Zendesk, also based in the U.S. This provider guarantees that the transfer is carried out under GDPR compliance with binding corporate rules.