Information on obtaining and processing personal data by
OLYMPIC CASINO SLOVAKIA s.r.o.

Mostova 2, 811 02 Bratislava, ID No.: 35 953 080, registered in the Commercial Register of the District Court Bratislava I., Section s.r.o, Insert No. 37413/B

I.  Introductory information
Company OLYMPIC CASINO SLOVAKIA s.r.o., Mostova 2, 811 02 Bratislava, ID No.: 35 953 080, registered in the Commercial Register of the District Court Bratislava I, Section s.r.o, Insert No. 37413/B (hereinafter referred to as "OCS") considers personal data protection to be their key obligation, always handling personal data exclusively in accordance with applicable law.

Having regard to the processing of personal data, OCS is primarily governed by Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons  with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46 / EC (General Data Protection Regulation) (hereinafter referred to as "Regulation") and by the Act No. 18/2018 Coll. on Personal Data Protection and on Amendments to Certain Acts (hereinafter "Act").

The purpose of this document is to provide the data subject with information regarding nature of personal data obtained by OCS, handling process, resources obtained, purposes for their processing, who they are provided to, duration of data retain and what the rights of the data subject are within data protection policy resulting from the Regulation and the Act in particular and further relevant information.

The information provided in this document is intended for: (i) current OCS customers (ii) former OCS customers (iii) potential OCS customers, (iv) authorised persons within a reasonable extent, (v) authorized persons (vi) authorized representatives of legal entities and (vii) other natural persons whose personal data are processed by OCS in connection with their activities (hereinafter referred to as "Data subject").

II.  Controller and Data protection officer
1. The controller for personal data processing is OLYMPIC CASINO SLOVAKIA s. r. o., Mostova 2, 811 02 Bratislava, ID No.: 35 953 080, registered in the Commercial Register of the Bratislava I District Court, Section s.r.o, Insert No. 37413/B (OCS).
2.  The data protection officer representing OCS is on phone +421 907 750 383, email: skinfo@oc.eu. The data protection officer shall respond to the data subject any questions regarding the processing of his or her personal data within OCS company.

III.  Scope and method of processing personal data
3.  OCS processes personal data of the data subject only to the extent necessary.

4.  OCS processes personal data of the data subject wholly or partly by automated means and the processing other than by automated means (including algorithmic processing) within the framework of OCS systems.
One way of processing personal data is the automated evaluation (profiling) of personal data about the data subject; thus generating derived data about the data subject. This is mainly provided for the fulfilment of the obligations arising from OCS from generally binding legal regulations, protection of the rights and the protected interests of OCS.

IV.  Voluntary nature of providing personal data and possible consequences of non-disclosure
5.  The provision of personal data is considered, alongside contract conclusion with OCS, voluntary. However, the provision of some personal data is necessary in order to fulfil OCS obligations, resulting from generally binding legal regulations, OCS cannot provide data subject by service or product requested without their former provision (e.g. OCS will not allow the data subject participation on game). Such instances shall be brought to the attention of the data subject. Some generally binding legal regulations of alike nature are stated below:

- Act No. 30/2019 Coll. on Gambling Games and on Amendments to Certain Acts (hereinafter referred to as "Gambling Act”)
- Act No. 297/2008 Coll. on the Prevention of Money Laundering and Terrorist Financing and on Changes and Amendments of some other acts (hereinafter referred to as "Prevention of Money Laundering and Terrorist Financing Act”)
- Act No. 431/2002 Coll. on  Accounting
- Act No. 395/2002 Coll. of Laws on Archives and Registries and on the Amendments to Certain Acts
- Act No. 595/2003 Coll. on Income Tax

V.  Personal data resources
6.  OCS obtains personal data of the data subject in the following manners:

- directly via the data subject,
- via publicly available registers, lists and records (business register, trade register, real estate register, public telephone directory, etc.),
- through other public resources (including social networks and internet information being publicized by the data subject),
- through other public authorities if provided by a special regulation,
- through persons interested in OCS products and services, within the framework of marketing campaigns and events,
- via other persons, if the data subject has given his or her consent or allowed this by setting up particular applications (e.g. cookies),
- within the scope of OCS's own activities, by processing and evaluating personal data.

VI.  Lawfulness and purpose of processing of personal data of the data subject  
7.   OCS processing shall be lawful only if and to the extent that at least one of the following applies:

- the data subject has given consent to the processing of his or her personal data for one or more specific purposes,
- processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract,
- processing is necessary for compliance with a respectable legal obligation to which OCS is subject,
- processing is necessary in order to protect the vital interests of the data subject or of another natural person,
- processing is necessary for the purposes of the legitimate interests pursued by OCS or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

8.  OCS processing of personal data of the data subject is carried out in accordance with the following purposes:

- for purposes defined in the consent to the processing of personal data
e.g.
- business communication in the chosen way (e-mail, text message, written form),
- for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract

e.g.
- the performance of the contract between OCS and the data subject. Personal data are needed, inter alia, in order to conclude a contract without undue legal risks, including negotiation of the conclusion or change of the contract with the data subject.

- fulfilment of OCS legal obligation

e.g.
- compliance with the obligations arising from the Act on the Prevention of Money Laundering and Terrorist Financing,
- compliance with the obligations arising from the Act on Gambling Games,
- compliance with the obligations arising from the Act on Laws on Archives and Registries,
- administrative compliance of reporting obligations towards public authorities,
- execution of the enforcement obligations.

- OCS legitimate interest

e.g.
- the protection of the rights and legitimate interests of OCS, legitimate recipients or other relevant persons, e.g. in the event of recovering receivables,
- the protection of OCS assets and the health of individuals in the casino
- development and progress of provided products and services,
- dealing with disputable agenda, for the purpose of conducting litigation or other disputes in particular,
- preventing fraudulent behaviour the data subject or OCS might be exposed to,
- offering products and services to customers without obtaining their prior consent (for direct marketing purposes),
- winnings payout to the customer's bank account on the basis of his or her request or definition of high volume winnings payout options in accordance with generally binding legal regulations.

VII.  Recipients and categories of recipients
9.  OCS shall provide personal data of the data subject to the following recipients:

- employees and persons authorized to act on behalf of OCS in connection with the fulfilment of their duties, respecting handling of the data subject personal data to the extent necessary and in compliance with all the security measures,
- state authorities, or other entities within the framework of legal obligations fulfilment stipulated by special regulations (e.g. Act on the Prevention of Money Laundering and Terrorist Financing and on Changes and Amendments of some other acts, the Gambling Act, etc.). These are mainly state administration bodies, law enforcement agencies, supervisory bodies, etc.
- other entities, in the event of protecting OCS rights, e.g. when applying OCS claim in a court way, court bailiff, etc. The extent of the personal data provided in such cases is limited to the data necessary for the successful exercise of respectable claim.
- specialized external entities (hereinafter referred to as an "Processor") who perform processing on behalf of OCS under the relevant personal data processing contract. OCS, upon careful consideration selects processor who shall guarantee and implement maximum technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed.
- suppliers providing OCS services such as mail forwarding, marketing information, IT service providers, etc.
- processors and third parties are listed in a separate document available on the following website  www.olympic-casino.sk .

- The OLYMPIC CASINO may provide the Club Card User’s personal data and data on using of Club Card to the companies operating within the Olympic Entertainment Group in order to protect risk management OCS and to the companies operating within the Olympic Entertainment Group, reporting, audit, inside control and statistical purpose. The Olympic Entertainment Group includes these companies: Olympic Casino Estonia, Olympic Casino Latvia, Olympic Casino Lithuania, Olympic Casino, Olympic Casino Italy and Casino Malta by Olympic Casino.

Any provision of the data subject personal data shall be carried out by OCS exclusively to the extent necessary and for a specific purpose based on one of the legal bases referred to in the paragraph 7.

VIII. Time of retention of personal data
10.   Retention periods of personal data are as follows:

- in the event where the legal basis for the processing of personal data is the consent of the data subject, OCS shall retain personal data of the data subject upon the withdrawal of the consent or the expiry of the period for which the consent has been granted,
- in the event where the legal basis for the processing of personal data is the fulfilment of the contract to which the data subject is a contractual party, or the request of the data subject to take the pre-closure action, OCS shall retain personal data of the data subject for the duration of the contractual relationship,
- in the event where the legal basis for the processing of personal data is the fulfilment of the statutory duty, OCS shall retain personal data of the data subject for a period specified in a respectable Act for a particular purpose (e.g. personal data of the data subject being processed for the purposes of the Act No. 297/2008 Coll. on the Prevention of Money Laundering and Terrorist Financing and on Changes and Amendments of some other acts are obliged to be retained within 5 years of termination of a contractual relationship),
- in the event where the legal basis of the processing of personal data is to protect the vital interests of the data subject or another natural person, OCS shall retain personal data of the data subject while the purpose of the processing on that legal basis is still in force,
- in the event where the legal basis of the processing of personal data is justified by the interest pursued by OCS or a third party, OCS shall retain personal data of the data subject while the purpose of the processing on that legal basis is still in force, until the event results in an earlier termination of the personal data processing (e.g. application of the right to object by the data subject).

IX.  Rights of the data subject in terms of his or her personal data processing
11.  Right of withdrawing the data subject consent on the processing of personal data.
For more information, see paragraph 22.

12.  Right of access to personal data by the data subject.
The data subject shall have the right to obtain from OCS confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

- the purposes of the processing;
- the categories of personal data concerned;
- the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
- where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
- the existence of the right to request from OCS rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
- the right to lodge a complaint with a supervisory authority;
- where the personal data are not collected from the data subject, any available information as to their source;
- the existence of automated decision-making, including profiling, referred to in Article 22 (1) and (4) of the Regulation, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

13. Right to rectification. The data subject shall have the right to obtain from OCS without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

14. Right to erasure (‘right to be forgotten’). The data subject shall have the right to obtain from OCS the erasure of personal data concerning him or her without undue delay and OCS shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing;
- the data subject objects to the processing of his or her personal data and there are no overriding legitimate grounds of OCS or the third person for the personal data processing, or the data subject objects to the processing pursuant to direct marketing purposes;
- the personal data have been unlawfully processed;
- the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which OCS is subject

15. Right to restriction of processing. The data subject shall have the right to obtain from OCS restriction of personal data processing where one of the following applies:

- the accuracy of the personal data is contested by the data subject, for a period enabling OCS to verify the accuracy of the personal data;
- the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of his or her use instead;
- OCS no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
- the data subject has objected to processing, pending the verification whether the legitimate grounds of the OCS override those of the data subject.

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person.

A data subject who has obtained restriction of processing shall be informed by OCS before the restriction of processing is lifted.

16. Right to data portability. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to OCS, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided. In exercising his or her right to data portability, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in OCS and shall not adversely affect the rights and freedoms of others.

17.  Right to object.
The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her. OCS shall no longer process the personal data unless demonstrating compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

18. Automated individual decision-making, including profiling. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

19. Right to initiate proceedings. The data subject shall implement suitable measures to initiate proceedings under the Act (§ 100) on Personal Data Protection (Office for Personal data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, Slovak Republic), www.dataprotection.gov.sk

20. The aforementioned rights of the data subject (paragraph 11 to 19) are specified in the Articles 7, 15 to 22 of the respectable Regulation.

X.   Method and contact details for exercising the rights of the data subject in relation to the processing of personal data
21. The data subject shall exercise his or her rights against OCS as follows:

-    in written at:                  OLYMPIC CASINO SLOVAKIA s.r.o., Mostova 2, 811 02 Bratislava
-    email to:                        skinfo@oc.eu
-    phone to:                       +421 907 750 383
-    in person:                      at the address: OLYMPIC CASINO SLOVAKIA s.r.o., Mostova 2, 811 02 Bratislava
or at the respectable subsidiaries of OLYMPIC CASINO  SLOVAKIA s.r.o.

In such cases, the data subject shall prove his or her identity or report his or her identification data in order to avoid confusion and the request of the data subject could be provided.

XI.  Right to withdraw consent for personal data processing
22. The data subject has the right at any time to withdraw consent to the processing of personal data (if consent is the legal basis of the processing) concerning him or her. Revocation of consent does not affect the lawfulness of the processing of personal data based on consent prior to its revocation. The data subject shall withdraw the consent in the same manner the consent has been granted. OCS shall, upon withdrawal of the consent of the respectable data subject, terminate the processing of personal data for the purpose for which the consent has been revoked.

The data subject shall withdraw consent as follows:

-  in written at:                  OLYMPIC CASINO SLOVAKIA s.r.o., Mostova 2, 811 02 Bratislava
-  email to:                        skinfo@oc.eu
-  phone to:                       +421 907 750 383
-  in person:                      at the address: OLYMPIC CASINO SLOVAKIA s.r.o., Mostova 2, 811 02 Bratislava
or at the respectable subsidiaries of OLYMPIC CASINO  SLOVAKIA s.r.o.

In such cases, the data subject shall prove his or her identity or report his or her identification data in order to avoid confusion and the request of the data subject could be provided.

XII.  Transfers of personal data to third countries or international organisations
23.  OCS binds not to transfer the data subject personal data to a third country or an international organisation. In the event of OCS attempt to transfer personal data, an approved certification mechanism together with binding and enforceable commitments of OCS in the third country or an international organisation, shall apply the appropriate safeguards, including the data subjects' rights and will proceed in accordance with the Regulation and the Act.

XIII.  Security of the processing of personal data
Personal data are under constant physical, electronic and procedural control, proving OCS has advanced control, technical and security mechanisms to ensure maximum protection of processed data against unauthorized access or transfer, loss or destruction, and other possible misuse. Any person coming in contact with the data subject in terms of performing his or her employment or contract obligations is bound by a statutory or contractual duty and reconciles the right to the protection of personal data with an obligation of professional secrecy.

XIV. The validity and effectiveness of the information in this document
24.  The information in this document is valid and effective from April of 1st, 2022 and is available at OCS subsidiaries and on the following website www.olympic-casino.sk . At the same time, an Information Memorandum on the obtaining and processing of personal data is available at respectable OCS subsidiaries, exclusively for casino customers.

Olympic Club Cards