Privacy Statement

The following legislation sets out the legal parameters governing the handling of personal data:

• Gambling Act (BGS)
• Gambling Ordinance (VGS)
• Casino Ordinance (SPBV-EJDP)
• Money Laundering Act (GwG)
• Money Laundering Ordinance (GwV – SFGB)
• Data Privacy Ordinance (DSV)
• European Union General Data Protection Regulation (GDPR)
• Swiss Code of Obligations (OR)

Our Privacy Statement is based on the provisions of the Swiss Data Privacy Act (DSG) and the European Union’s General Data Protection Regulation (GDPR). SWISS CASINOS is subject to this European regulation in cases where our businesses or third parties acting on our behalf collect and process data pertaining to persons with permanent residence in the EU for marketing and customer retention purposes. In all other cases, firstly, in our business relationships with customers whose permanent place of residence (domicile) is Switzerland and secondly, in the context of strict state controls governing casinos and online gambling, Swiss law (Gambling Act, Data Privacy Act and Ordinance) shall apply. Job applicants are also regulated for by Article 328b of the Swiss Code of Obligations.

SWISS CASINOS only collects and processes personal data that is required by law and/or that we deem necessary for the long-term success of our company group. Furthermore, in processing the data entrusted to us, SWISS CASINOS always makes every effort to safeguard the privacy rights of those concerned. This is also in our own interests. In handling personal data, we respect the following principles:

Data transfer

We work with a number of specialist third-party companies in order to offer visitors to SWISS CASINOS and users of our online services, accessed via the homepages www.swisscasinos.ch and www.george-grill.ch, a unique and flawless experience.

We only pass on personal data to third parties insofar as permitted by law and where practical for our business and strictly necessary for providing services. In such cases, the data may only be stored and/or processed where this is required for a clearly defined purpose and for the fulfillment of contractual obligations towards SWISS CASINOS. The rights and obligations of our cooperation partners are regulated in their data processing agreement with SWISS CASINOS. We also have separate non-disclosure agreements (NDA) with all third parties, who are granted permission to view our personal data in order to fulfill their contractual obligations. In accordance with our duty of documentation, we keep an up-to-date list of the companies with which we have privacy-relevant contractual ties.

Where SWISS CASINOS can exert no influence or only limited influence over a company’s control of personal data (e.g. in the case of large overseas IT organizations such as Google, Microsoft, Facebook, etc.), we encourage persons concerned to visit the relevant providers’ websites to find out how these organizations handle their personal data. Most of these large groups have privacy certification (e.g. EU-US Privacy Shield, CH-US Privacy Shield), guaranteeing that they will follow the relevant country’s privacy regulations when processing data in the United States. Furthermore, these companies, as a rule, offer users extensive control over the use of their own personal data (see various social media providers’ apps).

Retention of personal data

We process and store your personal data for as long as required for the fulfillment of our contractual and statutory obligations or for as long as the relevant purpose requires – for example, for the duration of the entire business relationship and beyond in accordance with statutory retention and documentation obligations. We may retain personal data for the length of time in which you may assert a claim against our company (i.e. in particular during the statutory limitation period) and insofar as we are otherwise obligated to by law or required to by legitimate business interests (e.g. evidential and documentation purposes). Once your personal data is no longer required for the purposes outlined in section 4, it is, wherever possible, deleted or anonymized. Shorter retention periods of twelve months or less apply to operational data (e.g. system protocols, logs).

Data security

Swiss Casinos actively manages data and explicitly trains its employees in information security and how to handle personal data. A Privacy Officer oversees the work of those responsible for privacy in each of the Swiss Casinos Group’s companies to ensure compliance with statutory requirements and internal guidelines.

“Authenticity, integrity, availability, and confidentiality” are the cornerstones of our approach to information security and hence privacy. Our privacy objectives are based on these principles. SWISS CASINOS uses popular state-of-the-art security technologies and defined quality assurance processes to record, store, archive and dispose of electronic and physical data. Companies that operate and maintain IT systems or gaming platforms on behalf of SWISS CASINOS are, as a rule, certified to international security standard ISO 27001 and employ cutting-edge tools to prevent personal data from being accessed by third parties.

Your rights

Under the applicable privacy law and insofar as this provides (as, for example, in the case of DSG or GDPR), every person has the right to access, rectify, block or erase their personal data, the right to restrict processing of their data, the right to object to us processing their personal data, and the right to obtain certain personal data for the purpose of transferring it to another environment (data portability).

You have the right to withdraw your consent at any time. This has no bearing on the legality of data processing carried out prior to this withdrawal. Bear in mind that asserting these rights conflicts with contractual agreements and this may have consequences, e.g. early termination of contract or cost implications. If this is the case, we will inform you in advance, providing this is not already covered in the contract.

In asserting such rights you will, as a rule, be required to prove your identity (e.g. with a copy of an ID, if your identity is not otherwise clear and cannot otherwise be verified). If you wish to assert your rights, you can contact us at one of the addresses shown in section 3.

You also have the right to enforce your claims in a court of law or to submit a complaint to the responsible privacy authority. The responsible privacy authority in Switzerland is the Federal Data Protection and Information Commissioner (http://www.edoeb.admin.ch).

Legal basis for processing personal data

As a user of our services, your declaration of consent confirms your consent to this Privacy Statement. The primary legal basis for the data processing procedures described here is Article 6(6) DSG. However, in addition to this declaration of consent, SWISS CASINOS reserves the right to invoke the following as a legal basis for data processing (see in particular Article 31 DSG in relation with Art. 51 BGS and 46 VGS):

• Where data processing is necessary in order to fulfill the contract, the legal basis shall be Article 31(2)(a) DSG. This also applies to any required precontractual processing steps.
• Where data processing is necessary in order to fulfill a legal obligation on the part of SWISS CASINOS (e.g. retention requirement), the legal basis shall be Article 31(1) DSG (in relation with Art. 51 BGS and 46 VGS).
• If data processing is required in order to safeguard a legitimate interest of SWISS CASINOS or a third party (e.g. for the assertion of claims) and the interests, fundamental rights, and fundamental freedoms of the user do not outweigh the aforementioned interest, the legal basis shall be Article 31(1) DSG .
• In the exceptional event that data processing is necessary in the vital interests of the user or another natural person, Article 31(1) DSG shall serve as legal basis.

Land-based casino business

Description, scope and purpose
Legislation governing casinos, Article 51 BGS and 46 VGS obliges SWISS CASINOS to record, verify, and maintain a series of personal details about its visitors for the purposes of preventing or minimizing risks such as money laundering, cheating and gambling addiction, and to ensure that games are played in a safe and transparent environment:

Additional legal bases for consent
Data is processed in response to a request by the individual interested in the land-based casino business, and processing is required for the stated purposes in order to fulfill the contract and carry out precontractual measures (Article 31(2)(a) DSG). Data is also processed on the basis of the legal obligations to which SWISS CASINOS is subject (Article 31(1) DSG in relation with Art. 51 BGS and 46 VGS), as listed in the table.

Assistive technology/Filing location
In pursuance of the stated purposes, the employees responsible record and process the aforementioned personal data within the Group’s own IT system using special applications (guest information system GIS, Cheeteye). The individual companies’ access regulations ensure that only those employees who are entrusted with implementing the social program are able to access the personal data.

Data transfer
The casinos are obliged by law to make the identity of persons who have been barred accessible to other casinos (Article 42 VGS). As prescribed, the information exchanged comprises personal details, the type of bar (self-imposed, ordered), the date it was issued, and the name of the casino imposing the bar. This exchange of information takes place via a central database to which all casinos in Switzerland are connected. As soon as the bar has been lifted, the casino responsible will make the data on the barred person inaccessible to the other casinos.

The individual casinos work with an addiction prevention organization and a therapy center in order to implement the social program (Article 81 (3) BGS). Personal data is only exchanged here when strictly necessary in order to process a concrete case. The Commission and authorities may demand to see the data, insofar as this is within their statutory remit.

Duty to provide information when collecting personal data
The gaming houses belonging to the Swiss Casinos group are legally entitled to process the personal data and sensitive data of their players without having to inform them (Art. 19 and 20 DPA in conjunction with Art. 51 BGS and Art. 46 VGS). To do so, they may, if the situation so requires, call on the services of a company specialising in credit information systems. Swiss Casinos works with CRIF SA, Hagenholzstrasse 81, 8050 Zurich. 

Retention
Different statutory retention periods apply, depending on the type of data:

• Personal data collected for reasons of compliance with statutory due diligence in relation to money laundering, cheating, and protection of players is deleted 10 years after our last business contact (Article 21 (4) GwV-SFGB).
• Video data is deleted after 28 days (Article 57(3) VGS).

Description, scope and purpose
SWISS CASINOS offers licensed online gambling opportunities on its websites. Like the casinos themselves (see section 4.1), these are strictly regulated by the Swiss Federal Gaming Board (SFGB). As in our casinos, personal data is only collected and processed where it is strictly necessary in order to comply with statutory requirements and due diligence (combating money laundering and cheating, protecting players).

All of this data is also used for marketing purposes within the company.
SWISS CASINOS relies on the specialized services of various companies to operate the technical infrastructure required (web and application servers, platform for free online games, mail server, hosting services, development of games software). In this context, the personal data is processed by the technical systems used by these cooperation partners for the purpose of fulfilling their contractual obligations to SWISS CASINOS.

Form of consent and right to object
When registering, participants consent to the use of their data for marketing purposes (Article 6(6) and Article 31 (1) DSG). The collection and use of the personal data required here are handled in the same way as when registering to use the free online games (see section 5.3). In their user account, participants can select to allow or refuse the use of their data for marketing purposes.

Additional legal bases for consent
Data is processed at the request of the individual interested in online gambling, and processing is required for the stated purposes in order to fulfill the contract and carry out precontractual measures (Article 31(2)(b) DSG). Data is also processed on the basis of the legal obligations to which SWISS CASINOS is subject (Article 31(1) DSG in relation with Art. 51 BGS and 46 VGS), as listed in the table in section 4.1.

Data transfer
The data is not passed on to companies outside the Swiss Casinos Group. The gaming operator which provides the technical platform for the online games is not able to see the personal data of registered users.

Retention of data, disabling accounts, deleting accounts
Account holders can demand that we disable their login for our online gambling services. The personal data collected to allow participation in the online games will then be anonymized. For reasons of combating crime and money laundering, certain information may not be deleted at the request of a client and must be retained for a period of 10 years after termination of the business relationship (Art. 21 GwV SFGB).

SWISS CASINOS constantly endeavors to offer visitors to its casinos special gambling opportunities and entertainment experiences tailored to their individual needs. To do this, we need to learn more about our guests so that we can be more focused in our communication. Like any success-oriented enterprise, SWISS CASINOS therefore collects and processes personal data, insofar as is necessary and permitted by law, for marketing purposes.
 

ROYAL CLUB

Description, scope and purpose
Membership of the ROYAL CLUB entitles guests to various special offers and discounts. The associated membership card also serves as proof of identity when entering the casino. On receiving an application and with the prior consent of the guest, SWISS CASINOS registers personal details in order to issue the membership card. These include:

• Personal details (surname, first name, date of birth, nationality, address)
• Contact details such as email address and cellphone number
• Photocopy plus type and number of official ID
• Date and time of visit to a Swiss Casinos Group casino
• Relevant interests such as type of gambling and events
• Profession

Additional legal bases for consent
Data is processed in response to a request by the individual interested in membership of the ROYAL CLUB, and is required for the stated purposes in order to fulfill the contract and carry out precontractual measures (Article 31(2)(b) DSG). Data is also processed in accordance with Article 46 VGS and on the basis of the legal obligations to which SWISS CASINOS is subject (Article 31(1)DSG in relation with Art. 51 BGS and 46 VGS), as listed in the table in section 4.1.

Assistive technology/Filing location
Because membership is associated with statutory due diligence (the membership card also serves as a form of identity), the personal data is entered in the guest information system (GIS) and processed there by the persons responsible in the individual companies (see previous section). The relevant personal data is also transferred to a group-wide SWISS CASINOS platform, where it is used for marketing activities in the companies and for certain monitoring activities to ensure compliance with statutory due diligence.

Data transfer
We do not pass on the data we collect to third parties. We reserve the right to disclose personal data if ordered to do so by a law enforcement agency, e.g. for criminal justice purposes.

Validity and retention
As a member, you may withdraw your consent to the use of your personal data for marketing purposes at any time. If you withdraw your consent, cancel your membership, or fail to renew your annual membership, your details will be retained for a period of 10 years after our last business contact (or from the date you last entered our premises) in accordance with statutory due diligence requirements (see section 4, last paragraph) and then deleted.

E-GUMA (voucher system and ticket system)

Description, scope and purpose
The SWISS CASINOS companies use E-GUMA software by software provider E-GUMA® (Idea Creation GmbH, Walchestrasse 15, CH-8006 Zurich – www.e-guma.ch) for the sale and administration of vouchers and tickets in the online shop.

To handle orders and purchases, we need to record and process the usual personal details that are required for such transactions (surname, first name, address, phone no., email address and, if applicable, credit card details).

Payment data is processed in the context of payment handling by Datatrans AG, Kreuzbühlstrasse 26, CH-8008 Zurich. Once you have placed an order, your details are passed to the shipping company tasked with delivering the goods, insofar as the goods require delivery.

In addition, when you visit the relevant website, information is stored temporarily on the server in log files. This information is sent automatically by the browser on your device (see section 6.1).

Additional legal bases for consent
Data is processed in response to a request by the individual interested in making a purchase, and processing is required for the stated purposes in order to fulfill the contract and carry out precontractual measures (Article 31(2)(b) DSG). SWISS CASINOS also has a legitimate interest in using E-GUMA software from software provider E-GUMA® for the voucher and ticket system (see Article 31(1) DSG).

Other privacy policies
Because each individual casino’s online shop is integrated in the relevant company’s website (i.e. using iFrames), each online shop has its own, detailed privacy policy, to which reference is made. This can be seen on the following websites:

Casino Zürich privacy policy
Casino St. Gallen privacy policy
Schaffhausen privacy policy
Eguma Shop privacy policy
Eguma Shop George Bar and Grill 

General privacy-related information about this online service can also be found under the “Privacy” link on the company’s online shop website.

Newsletter

Description, scope and purpose
When you set up an account, submit an application (e.g. for ROYAL CLUB membership) or purchase services online, SWISS CASINOS may ask if you would like to subscribe to a free newsletter. For the newsletter subscription, we only record and use personal details that we need in order to send you the newsletter – for example:

• Surname and first name
• Email address (required for secure double opt-in)
• Cellphone no. (if you wish to receive the newsletter by text or via WhatsApp)

Form of consent and right to object
By actively selecting the relevant click box or providing your signature, you are confirming that you would like to receive the newsletter or news updates via email, SMS/MMS or WhatsApp and that you have read, understood, and accept the associated terms and conditions (GTC). Where other personal data is collected during the registration process – for example, IP address, date and time – this is designed to prevent misuse of the services or of the email address provided. Subscribers to the newsletter can unsubscribe at any time using the link on the website or in the newsletter.

Additional legal bases for consent
Data is processed in response to a request by the individual interested in the newsletter, and processing is required for the stated purposes in order to fulfill the contract and carry out precontractual measures (Article 31(2)(b) DSG). SWISS CASINOS also has a legitimate interest in providing recipients of the newsletter with the latest information about the company (see Article 31(1) DSG).

Data transfer
The information you provide when you subscribe to the newsletter is used exclusively to send you the newsletter and is not passed on to third parties.

Description, scope and purpose
Via its online presence, SWISS CASINOS is, in many respects, in direct ‘virtual’ contact with interested users and visitors. We use new technologies and media in order to find out more about our visitors, recruit potential employees, respond to users’ queries, and offer visitors high-quality services, tailored to their needs. User data is also wittingly or unwittingly accrued in connection with the online services we use, and visitors to our website or users of our services are legally entitled to information and control of this data at any time.

Below we outline how we implement privacy protection in connection with our web presence on the following home pages:
www.swisscasinos.ch
www.swissonlinegames.ch
www.george-grill.ch
www.spielerschutz.ch

Duration of storage
Your personal data will be deleted or disabled once the purpose for which it was saved no longer applies. The data may be stored beyond this if this is provided for by the European or national legislator in Union directives, laws or other regulations to which the responsible party is subject. Data will also be disabled or deleted as soon as a retention period specified in the named standards expires, unless further storage of the data is required in order to conclude or fulfill a contract.

Additional legal bases for consent
The personal data required for the use of the services indicated below is collected and processed as a result of the user’s interest in the SWISS CASINOS website and is required for the stated purposes (Article 31(2)(b) DSG). SWISS CASINOS also has a legitimate interest in a website and the services indicated below, as well as in improving the quality of its online presence (see Article 3(1) DSG).

Website visits and the creation of log files

Description, scope and purpose
All of the data on the websites operated by SWISS CASINOS is stored on METANET’s servers.

Whenever anyone accesses our website, the aforementioned provider automatically records data and information about the requesting computer. The following data is collected and stored in a log file:
-    Date and time of access
-    URL of the page visited
-    Referrer website
-    IP address
-    Browser used
-    Operating system used
-    Technical information on the transfer of data (e.g. quantity of data transmitted, protocol used, method used, transfer status)

This data is not stored in conjunction with other personal data relating to the user. For technical reasons, the system needs to store your IP address temporarily in order to display the website on your device. To this end, we need to store your IP address for the duration of the browser session. In addition, the provider automatically saves it in log files. The data is collected and processed for the purposes of carrying out internal system analyses and safeguarding technical security. The logged data can be used to counter attempted attacks on the web server and to carry out checks where there is a suspicion of misuse or criminal activity. The IP address is only analyzed where there are concrete concerns about illegal use of the website or the associated systems. We do not analyze log files for marketing purposes.

Duration of storage
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. Where the IP address is recorded in order to display the website, data is deleted as soon as you end the browser session. The log files are deleted at the end of the following month (i.e. a maximum of two months after you visited the website).

6.2    Use of cookies
Description, scope and purpose
Our website uses cookies, i.e. text files containing a string of characters, stored on your computer system (PC, cellphone) via the browser when you visit a website. When you revisit the website, the cookie makes your browser uniquely identifiable and allows us to technically optimize our website for you.

All of the cookies we use are listed by category below. The different cookie categories were developed by the UK’s International Chamber of Commerce. The categories make it easier to explain which cookies we use, why we use them, and what functionality you will lose if you decide not to allow cookies on your device. The cookie categories are as follows:

• Strictly necessary cookies
• Performance cookies
• Functionality cookies
• Targeting cookies and advertising cookies

The online portals operated by SWISS CASINOS only use performance cookies. These collect anonymous information on the pages you visit. By using our website, you consent to this type of cookie being placed on your device. These cookies collect information about how visitors use the website – for instance, which pages visitors go to most often, and if they get error messages from web pages. These cookies don’t collect information that identifies a visitor. All information these cookies collect is aggregated and therefore anonymous. They are only used to improve how the website works.

Duration of storage, right to reject, and right to delete
Depending on the type of cookies (“session cookies,” “permanent cookies”), they can be stored for a matter of minutes to up to two years (see table above). As the user, however, you have full control over the use of cookies. You can adjust your browser settings to reject cookies, allow them for just one session, or delete them ahead of the scheduled time. Cookies that have already been saved on your device can be deleted at any time. Bear in mind that deactivation may mean that you are no longer able to use all of the website’s features.

Google Analytics

Description, scope and purpose
On SWISS CASINOS websites, we use various plug-ins and tools, provided and operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 U.S.A. (“Google”).

Among the most important of these is Google Analytics. This is a web analytics service that tracks and reports traffic on our website. Our legitimate interest lies in the analysis, optimization, and cost-effective operation of our online presence.

Usage- and user-related information, e.g. IP address, location, time, or frequency of visits to our websites, are transferred to a Google server in the United States and saved there. To make it impossible to draw any conclusions about the identity of the user, SWISS CASINOS uses the Google Analytics IP anonymization feature, whereby Google truncates the IP address within the EU or EEA. At the same time, Google uses this information to provide tailored analyses of traffic and usage activities on our websites.

Online job applications and speculative applications

Description, scope and purpose
Visitors to the SWISS CASINOS website may apply for an advertised post or submit a speculative application via our online portal. The personal details required are recorded using electronic forms. When an application is submitted, we process the relevant information in accordance with our internally defined procedures, with the aid of commonly used IT tools.

Data transfer
Applicants’ personal data is only transferred to third parties for further stages of the recruitment process (e.g. assessments). In such cases, applicants are informed in advance.

Data deletion and retention
Once a contract of employment has been drawn up, the electronic application documents are saved in the employee’s personnel file and processed according to legally compliant in-house guidelines.

Electronic data pertaining to unsuccessful candidates is deleted, unless the person concerned expressly consents to the retention of their data (e.g. for inclusion in a database of applicants or potential customers). Physical application documents are returned to the unsuccessful candidates.

Right to object and right to delete
You can withdraw your consent at any time with immediate effect. In cases where SWISS CASINOS has a legitimate interest in using your personal application data as evidence for legal defense or prosecution purposes in a possible court case, these may be stored until the court case has concluded (Article 328b OR).

Contact options

Description, scope and purpose
Our website provides various forms that visitors can complete. These include the following:

• Press inquiries
• Questions concerning the use of free online games
• Registration for specific events
• Requests for a quote for a casino event casino
• Job applications and speculative applications (see section 6.6)
• General contact and inquiries

We only ask you for personal details that are necessary in order for us to reply to or process your inquiry. Required fields (first name and surname, email address, telephone number and message) are marked with an asterisk (*). At SWISS CASINOS, the contact details entered by the user will be processed solely for the purpose stated on the form.

Assistive technology and filing location
When contact forms are submitted, the email addresses contained on the form are used to send the submitted data to the relevant office for processing and, to safeguard the data, they are also saved in the content management system (CMS).

Retention and deletion of data
Once an inquiry has been dealt with conclusively (or is no longer relevant), the user’s personal data is deleted, unless

• its deletion would contravene a statutory retention requirement
• the process needs to be documented owing to an existing or potential subsequent contractual relationship between the inquirer and SWISS CASINOS
• the user expressly consented, when submitting the form, to further use of the data (e.g. for advertising purposes, inclusion in a database of applicants, newsletter).

Activation
This Privacy Statement came into force on July 2, 2018 and was last amended on October 9, 2023.